CVE-2026-74629: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74629 Overview

CVE-2026-74629 is a memory safety vulnerability in the Linux kernel's net/dibs subsystem. The flaw involves incorrect freeing of the dmb_clientid_arr structure, producing both a use-after-free (UAF) and a double-free condition. A dibs device interrupt handler can remain active after dibs_dev_del() returns and continue accessing dmb_clientid_arr memory. Additionally, if dibs_dev_add() fails when invoked from dibs_lo_dev_probe(), the array is freed twice. The upstream fix relocates the free operation to dibs_dev_release() so it executes only after the last reference is dropped.

Critical Impact
Attackers on an adjacent network can trigger kernel memory corruption leading to code execution, privilege escalation, or system crash.

Affected Products

Linux kernel builds containing the net/dibs subsystem prior to the patched commits
Distributions shipping vulnerable stable kernel branches
Systems using dibs loopback devices via dibs_lo_dev_probe()

Discovery Timeline

2026-08-22 - CVE-2026-74629 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74629

Vulnerability Analysis

The vulnerability resides in the lifecycle management of the dmb_clientid_arr allocation within the net/dibs subsystem. The subsystem originally released this array during dibs_dev_del(), which does not synchronize with in-flight interrupt handlers. As a result, an interrupt handler firing after device deletion dereferences freed memory, producing a use-after-free primitive in kernel context.

A second defect emerges on the error path of dibs_dev_add(). When dibs_lo_dev_probe() invokes dibs_dev_add() and the call fails partway through initialization, the cleanup logic frees dmb_clientid_arr while a later teardown path also releases the same allocation. This produces a double-free that corrupts kernel slab metadata.

The upstream commits move deallocation into dibs_dev_release(), which runs only after the reference count reaches zero. This ensures that no interrupt handler holds an outstanding pointer and that error paths cannot free the array twice.

Root Cause

The root cause is object-lifetime mismanagement. The dmb_clientid_arr allocation was released before all references to it had been retired, and the error-handling path in dibs_dev_add() duplicated the release without accounting for cleanup performed by callers such as dibs_lo_dev_probe().

Attack Vector

Exploitation requires adjacent-network access to reach the dibs device path and no authentication or user interaction. An attacker who can influence device probe failures or trigger interrupts against a torn-down dibs device can force the kernel into the vulnerable code path. Successful exploitation targets kernel slab allocator state to achieve arbitrary write primitives or control flow hijacking.

No public proof-of-concept exploit is currently available for CVE-2026-74629. Technical details are described in the upstream commit messages referenced below.

Detection Methods for CVE-2026-74629

Indicators of Compromise

Kernel oops or panic traces referencing dibs_dev_del, dibs_dev_add, dibs_dev_release, or dmb_clientid_arr
KASAN reports flagging use-after-free or double-free in the net/dibs code path
Unexpected slab corruption warnings (SLUB: kmalloc-*) coinciding with dibs device probe activity

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface UAF and double-free conditions in net/dibs
Monitor dmesg and /var/log/kern.log for stack traces containing dibs-related symbols
Track loaded kernel version against the fixed commits 7a1df20a, 9e6869be, and ece6426b

Monitoring Recommendations

Alert on repeated kernel warnings or panics on hosts using dibs loopback devices
Ingest kernel audit and crash telemetry into a centralized SIEM for correlation across the fleet
Track package inventory to identify hosts still running unpatched kernel versions

How to Mitigate CVE-2026-74629

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits 7a1df20a8d2c, 9e6869be4906, and ece6426b6124
Update to a distribution kernel package that incorporates the fix
Restrict adjacent-network access to hosts exposing dibs devices until patched
Reboot affected systems after applying the updated kernel to activate the fix

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Refer to Linux Kernel Commit 7a1df20a, Linux Kernel Commit 9e6869be, and Linux Kernel Commit ece6426b. The corrected code moves dmb_clientid_arr deallocation into dibs_dev_release() so it runs after the final reference is dropped.

Workarounds

Blacklist or unload the dibs kernel module on systems that do not require it
Segment adjacent-network access to reduce exposure of vulnerable interfaces
Disable dibs loopback device probing where operationally feasible until a patched kernel is deployed

bash

# Example: prevent the dibs module from loading until patched
echo "blacklist dibs" | sudo tee /etc/modprobe.d/blacklist-dibs.conf
sudo depmod -a
sudo update-initramfs -u