CVE-2026-74690 Overview
CVE-2026-74690 is a use-after-free vulnerability in the Linux kernel's s390/ism driver. The flaw occurs during ism_dev_exit() when an ISM interrupt handler runs in parallel with device teardown. The handler accesses the Shared Buffer Area (SBA) and Interrupt Event Queue (IEQ) structures after they have been freed. The upstream fix drains pending interrupt handlers via free_irq() before releasing the associated data structures.
Critical Impact
A local attacker on IBM Z (s390) systems can trigger memory corruption in kernel space, leading to privilege escalation, denial of service, or arbitrary code execution in the kernel context.
Affected Products
- Linux kernel builds for the s390 architecture that include the ism driver
- Distributions shipping affected stable kernel branches referenced in the upstream commits
- IBM Z systems using Internal Shared Memory (ISM) devices
Discovery Timeline
- 2026-08-22 - CVE-2026-74690 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74690
Vulnerability Analysis
The Internal Shared Memory (ISM) driver on s390 supports high-speed communication between LPARs and virtual machines. The driver allocates two key data structures during initialization: the Shared Buffer Area (SBA) and the Interrupt Event Queue (IEQ). Both structures are referenced by the ISM interrupt handler when the device signals events.
During ism_dev_exit(), the driver unregisters the IEQ and frees the SBA and IEQ memory. However, the original teardown sequence did not synchronize with in-flight interrupt handlers. An interrupt that fired just before unregister_ieq() could continue executing on another CPU while the exit path proceeded to release memory. The result is a classic use-after-free (UAF) condition on kernel-managed structures.
Root Cause
The root cause is missing synchronization between the interrupt teardown and memory release paths. Although unregister_ieq() prevents new interrupts from being generated, it does not wait for handlers already executing on other cores to complete. Freeing the SBA and IEQ before draining outstanding handlers leaves a race window in which the handler dereferences freed kernel memory.
Attack Vector
Exploitation requires local access to a system running an affected s390 kernel with the ISM driver active. An attacker with the ability to trigger device attach/detach cycles or to load and unload the driver can race the interrupt path against the exit path. Successful exploitation corrupts kernel memory, which can be leveraged for privilege escalation or kernel panic. The vulnerability is not exploitable remotely and requires no user interaction.
The upstream fix moves free_irq() ahead of the SBA and IEQ deallocation. free_irq() blocks until all in-flight handlers complete, closing the race window. See the technical references for the patch commits 774394d, b1896543, and fc302128.
Detection Methods for CVE-2026-74690
Indicators of Compromise
- Kernel panics or oops messages referencing s390/ism, ism_dev_exit, or ISM interrupt handling functions
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free access to SBA or IEQ structures on s390 kernels
- Unexpected reboots or hangs correlated with ISM device removal or driver unload events
Detection Strategies
- Inventory s390/IBM Z systems and identify kernels that include the ism driver without the patch commits 774394d, b1896543, or fc302128
- Enable KASAN on non-production s390 kernels to surface UAF conditions during driver lifecycle testing
- Monitor kernel ring buffer output for repeated ISM-related warnings that could indicate exploitation attempts
Monitoring Recommendations
- Forward dmesg and journald kernel logs from s390 hosts to a central logging pipeline for anomaly review
- Alert on privileged operations that load or unload the ism module, or that trigger device hot-unplug events
- Track unexpected process privilege changes on affected hosts, since kernel UAF exploitation may culminate in privilege escalation
How to Mitigate CVE-2026-74690
Immediate Actions Required
- Apply the patched kernel from your distribution vendor as soon as it is available for affected s390 branches
- Restrict local shell access on IBM Z systems to trusted administrators until patching is complete
- Audit which users and services can trigger ISM device lifecycle operations, and remove unnecessary privileges
Patch Information
The fix is available in the mainline Linux kernel through commits Kernel Commit 774394d, Kernel Commit b1896543, and Kernel Commit fc302128. The patch relocates the free_irq() call in ism_dev_exit() so that all in-flight interrupt handlers complete before the SBA and IEQ structures are released. Backports are being applied to stable kernel trees; consult your Linux distribution's security advisories for build-specific availability.
Workarounds
- If patching is not immediately feasible, avoid unloading or reinitializing the ism driver while the system is under load
- On systems that do not require ISM connectivity, blacklist the ism kernel module to remove the attack surface entirely
- Enforce least privilege for kernel module management and device administration to reduce the number of users who can trigger the race
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
