CVE-2026-74576

7.5

Linux · Kernel

An unbounded recursion vulnerability in the Linux kernel slab allocator can occur during the free path, potentially leading to a system crash or denial of service.

Executive summary

An unbounded recursion flaw in the Linux kernel slab allocator poses a significant risk of system denial of service.

Vulnerability

The vulnerability is an unbounded recursion issue within the memory management slab allocator. It occurs during object deallocation when specific allocation patterns trigger recursive calls, which can lead to stack exhaustion and system instability.

Business impact

Exploitation of this vulnerability causes kernel stack exhaustion, which typically results in an immediate system crash. This poses a severe risk to business continuity, particularly for high-uptime servers and critical infrastructure. The CVSS score of 7.5 highlights the significant impact on system availability.

Remediation

Immediate Action: Update the Linux kernel to version 6.12.103, 6.18.44, 7.1.8, or later as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for unexpected reboots or kernel stack overflow warnings.

Compensating Controls: Limit access to system-level interfaces that trigger complex memory allocation patterns to reduce the attack surface.

Exploitation status

Public Exploit Available: Unknown

Analyst recommendation

This vulnerability represents a critical threat to system stability. Security teams should expedite the deployment of patched kernels to prevent potential system crashes and ensure continuous service availability.

More Linux CVEs