CVE-2026-74482
7.8Linux · Kernel
A memory management flaw in the Linux kernel allows local attackers to trigger a use-after-free condition by incorrectly handling i_mmap_rwsem during page splitting.
Executive summary
A high-severity memory management vulnerability in the Linux kernel could allow a local attacker to perform unauthorized memory operations, leading to privilege escalation or system crashes.
Vulnerability
The vulnerability resides in the __folio_split function, where the i_mmap_rwsem is not correctly managed during folio operations. A local attacker with low privileges can exploit this race condition to access freed memory.
Business impact
This vulnerability poses a significant risk to system security by potentially allowing for privilege escalation. With a CVSS score of 7.8, it is critical for organizations to address this flaw to prevent unauthorized access or system-wide denial-of-service, especially on servers hosting sensitive data.
Remediation
Immediate Action: Update the Linux kernel to version 6.6.151, 6.12.103, 6.18.44, or 7.1.8 to resolve the memory handling error.
Proactive Monitoring: Review system logs for signs of segmentation faults or unexpected memory access errors that may indicate an attempt to trigger this vulnerability.
Compensating Controls: Restrict access to the system to authorized personnel and ensure all security-critical processes are running with appropriate isolation.
Exploitation status
Public Exploit Available: No
Analyst recommendation
Given the potential for privilege escalation, patching is essential. Administrators should ensure that all Linux-based systems are updated to the latest stable kernel releases to close this security gap.