CVE-2026-74482

7.8

Linux · Kernel

A memory management flaw in the Linux kernel allows local attackers to trigger a use-after-free condition by incorrectly handling i_mmap_rwsem during page splitting.

Executive summary

A high-severity memory management vulnerability in the Linux kernel could allow a local attacker to perform unauthorized memory operations, leading to privilege escalation or system crashes.

Vulnerability

The vulnerability resides in the __folio_split function, where the i_mmap_rwsem is not correctly managed during folio operations. A local attacker with low privileges can exploit this race condition to access freed memory.

Business impact

This vulnerability poses a significant risk to system security by potentially allowing for privilege escalation. With a CVSS score of 7.8, it is critical for organizations to address this flaw to prevent unauthorized access or system-wide denial-of-service, especially on servers hosting sensitive data.

Remediation

Immediate Action: Update the Linux kernel to version 6.6.151, 6.12.103, 6.18.44, or 7.1.8 to resolve the memory handling error.

Proactive Monitoring: Review system logs for signs of segmentation faults or unexpected memory access errors that may indicate an attempt to trigger this vulnerability.

Compensating Controls: Restrict access to the system to authorized personnel and ensure all security-critical processes are running with appropriate isolation.

Exploitation status

Public Exploit Available: No

Analyst recommendation

Given the potential for privilege escalation, patching is essential. Administrators should ensure that all Linux-based systems are updated to the latest stable kernel releases to close this security gap.

More Linux CVEs