CVE-2026-74617 Overview
CVE-2026-74617 is a Linux kernel vulnerability in the dibs (Direct Internal Buffer Sharing) subsystem. The flaw stems from uninitialized use of dibs->lock, which is initialized inside dibs_dev_add() but can be accessed earlier through the interrupt path. The ism_probe() function calls ism_dev_init() and registers an interrupt handler via request_irq() before dibs_dev_add() executes. A GID event interrupt arriving in this window causes ism_handle_irq() to acquire an uninitialized spinlock, leading to undefined kernel behavior.
Critical Impact
An early interrupt on an ISM device can cause the kernel to operate on an uninitialized spinlock, resulting in memory corruption, deadlock, or denial of service in the Linux kernel networking subsystem.
Affected Products
- Linux kernel (upstream) containing the dibs subsystem and ISM device driver
- Distributions shipping kernels prior to the fixing commits 2926031, c27e3605, and fe79571f
- Systems using IBM ISM (Internal Shared Memory) devices for SMC-D communication
Discovery Timeline
- 2026-08-22 - CVE-2026-74617 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74617
Vulnerability Analysis
The vulnerability affects the dibs device abstraction used by the ISM driver in the Linux kernel. The dibs structure includes a spinlock (dibs->lock) that serializes access to device state and interrupt handling. The original code path initializes this lock inside dibs_dev_add(), which runs after the device is already capable of receiving hardware interrupts. This creates a race window during driver probe in which the interrupt handler can execute against uninitialized synchronization state.
While no client can register a data message buffer (DMB) before dibs_dev_add() completes, the hardware can still deliver a GID event interrupt. When ism_handle_irq() executes, it acquires dibs->lock unconditionally before performing any further checks. Acquiring an uninitialized spinlock leads to unpredictable behavior, including corrupted lock state, kernel lockups, and potential memory corruption in adjacent structures.
Root Cause
The root cause is an initialization ordering defect [CWE-908: Use of Uninitialized Resource]. The synchronization primitive is initialized in dibs_dev_add(), but the driver publishes the device to the interrupt handler earlier through request_irq() inside ism_dev_init(). The fix moves the lock initialization into dibs_dev_alloc(), ensuring the lock is valid as soon as a driver can expose the device to its interrupt handler.
Attack Vector
Exploitation requires triggering the race between request_irq() and dibs_dev_add() during driver probe. On systems with ISM hardware, a GID event delivered during the initialization window causes the interrupt handler to operate on an uninitialized lock. The condition manifests as a kernel-side memory safety issue rather than a user-controlled input flaw, and the practical attack surface depends on the presence and behavior of ISM devices during probe.
See the upstream commits for the exact code change: Kernel Git Commit 2926031, Kernel Git Commit c27e3605, and Kernel Git Commit fe79571f.
Detection Methods for CVE-2026-74617
Indicators of Compromise
- Kernel panics or soft lockups referencing ism_handle_irq, dibs_dev_add, or dibs_dev_alloc in call traces.
- Lockdep warnings such as BUG: spinlock bad magic or INFO: trying to register non-static key associated with the ISM driver during boot or module load.
- Unexpected system hangs during initialization of ISM devices on affected s390 or virtualized platforms.
Detection Strategies
- Compare the running kernel version and vendor backport status against the fixing commits 2926031, c27e3605, and fe79571f.
- Enable CONFIG_DEBUG_SPINLOCK and CONFIG_PROVE_LOCKING in test kernels to surface uninitialized lock use.
- Collect and inspect dmesg output at boot for ISM-related probe errors on systems that expose ISM hardware.
Monitoring Recommendations
- Forward kernel logs to a centralized log platform and alert on stack traces containing dibs_ or ism_handle_irq symbols.
- Track kernel package inventory across the fleet and flag hosts running kernels older than the vendor patch level.
- Monitor host availability and unexpected reboots on systems with ISM devices to detect exploitation-related instability.
How to Mitigate CVE-2026-74617
Immediate Actions Required
- Apply the vendor-provided kernel update that includes the fix moving dibs->lock initialization into dibs_dev_alloc().
- Reboot affected hosts after patch installation so the new kernel and driver initialization order take effect.
- Prioritize patching on systems that expose ISM hardware or run SMC-D workloads.
Patch Information
The upstream fix initializes dibs->lock in dibs_dev_alloc() so the spinlock is valid before any interrupt handler can run against the device. The fix is available in the following commits: Kernel Git Commit 2926031, Kernel Git Commit c27e3605, and Kernel Git Commit fe79571f. Consume the fix through your distribution's stable kernel channel.
Workarounds
- On systems that do not require ISM functionality, blacklist the ism kernel module to prevent probe of the affected device.
- Restrict which workloads run on hosts with ISM hardware until patched kernels are deployed.
- Track vendor backports for long-term-support kernel branches and validate the fix is present before returning hosts to production.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
