CVE-2026-74672 (GCVE-0-2026-74672)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-23 12:47
VLAI
EPSS
VEX
Title
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable
freeing", v6.
Kernel page table walkers fall into two broad categories - those ranges
where no exclusion is required via walk_kernel_page_table_range_lockless()
and those where exclusion is required via walk_kernel_page_table_range()
or walk_page_range_debug().
The former category is used only by arm64 arch code operating on ranges it
both wholly owns and does not concurrently write.
The latter category consists of kernel page table walkers operating on
ranges that are wholly owned (but which need exclusion against concurrent
writers).
The lock used for exclusion is the mmap lock, and for kernel ranges this
is the mmap lock on init_mm.
ptdump is a special case being both the only user of
walk_page_range_debug(), and the only case in which it walks ranges it
does not own.
This presents a problem, as page tables may be freed under ptdump. And
indeed there is a use-after-free bug in the kernel as a result, which this
series addresses.
vmap promotes page tables to huge leaf entries where possible, freeing the
lower page table when it does. It does this with no meaningful locks held
against concurrent ptdump walks.
As a result, use-after-free can currently occur. This series addresses
the issue by having the vmap huge promotion logic acquire the mmap read
lock while both setting the huge page table entry and freeing the prior
leaf page table.
The ptdump code already acquires the mmap write lock, so by doing so we
ensure that the ptdump walker only ever observes either the huge page
table entry or the existing page table entry, and nothing is freed
underneath it.
A mitigation for this issue was already applied for arm64 in commit
fa93b45fd397 ("arm64: Enable vmalloc-huge with ptdump"), which this series
has to deal with carefully.
This mitigation resolves the issue by acquiring the mmap read lock on
init_mm on vmap page table free if a ptdump is in progress.
However the fix in this series would cause a deadlock if we were to simply
apply it for arm64 without also reverting the change.
This is because vmap may acquire the read lock before ptdump attempts to
acquire the write lock, which then gets queued, and rwsem starvation rules
mean that the (unacknowledged) nested mmap read lock in the arm64 code
would also block, meaning the original read lock is never released and
thus deadlock.
This series works around this by #ifndef CONFIG_ARM64'ing the mmap read
lock in vmap logic, then partially reverting commit fa93b45fd397 ("arm64:
Enable vmalloc-huge with ptdump"), keeping the enablement of huge vmap
support, and removing the ifdeffery with the partial revert patch.
There are related issues that are also addressed in this series:
* x86 page attribute logic, specifically Change Page Attributes (CPA),
implements a feature whereby huge ranges can be collapsed into huge leaf
entries. This can similarly cause a UAF when done in parallel with a
ptdump walk, so similarly acquire the init_mm mmap lock to avoid this.
* The CPA logic allows concurrent page table manipulation and CPA
collapse, meaning the former risks accessing a page table the latter
frees. Fix this by acquiring mmap write lock on init_mm across the
whole CPA collapse operation and read lock on the page table
manipulation.
* x86 and arm64 permit walks of non-kernel mm's (both allowing efi mm
walks, and in x86's case arbitrary mm's), so we ensure kernel mappings
remain stable by locking the init_mm as well as the mm being walked.
The ordering of patches is established for both strict dependencies (the
arm64 partial revert in particular has to be done after the vmap changes)
and logical ones (the non-kernel mm fix only makes sense once the vmap/CPA
fixes are in place).
This patch (of 3):
Currently there is a nasty ra
---truncated---
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e , < 39c6772b56a6bbdd62794833f74232971d94d7c9
(git)
Affected: b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e , < 8d7f560f4b0482d469de962fbe4b59c37561052e (git) Affected: b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e , < 7ac8a333dd41ba5e1b4e8c6edbc48b15446c5468 (git) Affected: b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e , < c5bf8cd148cfea948cfa3db71da427294b20db0f (git) Affected: b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e , < 3cc26c8907db0f5d1ff8043b5851ee572e9b3c98 (git) Affected: b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e , < 26444eb71465c9934d9d418ef69c43f61185329b (git) Affected: 31895cfd79564111cdd5a9f48c5d491ae26a238e (git) Affected: 9c7f7bdb1932f8c1e5f80d32c717184701afe701 (git) Affected: acdb4981644c8e31ccee294bdefff475c0cf587b (git) Affected: 0454e2fad9306961540ee7e84da47a8e345b7d22 (git) Affected: 4.4.125 , < 4.5 (semver) Affected: 4.9.91 , < 4.10 (semver) Affected: 4.14.31 , < 4.15 (semver) Affected: 4.15.14 , < 4.16 (semver) |
guessed | |
| Linux | Linux |
Affected:
4.16
Unaffected: 0 , < 4.16 (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/mmap_lock.h",
"mm/pagewalk.c",
"mm/vmalloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "39c6772b56a6bbdd62794833f74232971d94d7c9",
"status": "affected",
"version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
"versionType": "git"
},
{
"lessThan": "8d7f560f4b0482d469de962fbe4b59c37561052e",
"status": "affected",
"version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
"versionType": "git"
},
{
"lessThan": "7ac8a333dd41ba5e1b4e8c6edbc48b15446c5468",
"status": "affected",
"version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
"versionType": "git"
},
{
"lessThan": "c5bf8cd148cfea948cfa3db71da427294b20db0f",
"status": "affected",
"version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
"versionType": "git"
},
{
"lessThan": "3cc26c8907db0f5d1ff8043b5851ee572e9b3c98",
"status": "affected",
"version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
"versionType": "git"
},
{
"lessThan": "26444eb71465c9934d9d418ef69c43f61185329b",
"status": "affected",
"version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
"versionType": "git"
},
{
"status": "affected",
"version": "31895cfd79564111cdd5a9f48c5d491ae26a238e",
"versionType": "git"
},
{
"status": "affected",
"version": "9c7f7bdb1932f8c1e5f80d32c717184701afe701",
"versionType": "git"
},
{
"status": "affected",
"version": "acdb4981644c8e31ccee294bdefff475c0cf587b",
"versionType": "git"
},
{
"status": "affected",
"version": "0454e2fad9306961540ee7e84da47a8e345b7d22",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.125",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.91",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.31",
"versionType": "semver"
},
{
"lessThan": "4.16",
"status": "affected",
"version": "4.15.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/mmap_lock.h",
"mm/pagewalk.c",
"mm/vmalloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.125",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.15.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF\n\nPatch series \"mm: fix UAF caused by race between ptdump and vmap pgtable\nfreeing\", v6.\n\nKernel page table walkers fall into two broad categories - those ranges\nwhere no exclusion is required via walk_kernel_page_table_range_lockless()\nand those where exclusion is required via walk_kernel_page_table_range()\nor walk_page_range_debug().\n\nThe former category is used only by arm64 arch code operating on ranges it\nboth wholly owns and does not concurrently write.\n\nThe latter category consists of kernel page table walkers operating on\nranges that are wholly owned (but which need exclusion against concurrent\nwriters).\n\nThe lock used for exclusion is the mmap lock, and for kernel ranges this\nis the mmap lock on init_mm.\n\nptdump is a special case being both the only user of\nwalk_page_range_debug(), and the only case in which it walks ranges it\ndoes not own.\n\nThis presents a problem, as page tables may be freed under ptdump. And\nindeed there is a use-after-free bug in the kernel as a result, which this\nseries addresses.\n\nvmap promotes page tables to huge leaf entries where possible, freeing the\nlower page table when it does. It does this with no meaningful locks held\nagainst concurrent ptdump walks.\n\nAs a result, use-after-free can currently occur. This series addresses\nthe issue by having the vmap huge promotion logic acquire the mmap read\nlock while both setting the huge page table entry and freeing the prior\nleaf page table.\n\nThe ptdump code already acquires the mmap write lock, so by doing so we\nensure that the ptdump walker only ever observes either the huge page\ntable entry or the existing page table entry, and nothing is freed\nunderneath it.\n\nA mitigation for this issue was already applied for arm64 in commit\nfa93b45fd397 (\"arm64: Enable vmalloc-huge with ptdump\"), which this series\nhas to deal with carefully.\n\nThis mitigation resolves the issue by acquiring the mmap read lock on\ninit_mm on vmap page table free if a ptdump is in progress.\n\nHowever the fix in this series would cause a deadlock if we were to simply\napply it for arm64 without also reverting the change.\n\nThis is because vmap may acquire the read lock before ptdump attempts to\nacquire the write lock, which then gets queued, and rwsem starvation rules\nmean that the (unacknowledged) nested mmap read lock in the arm64 code\nwould also block, meaning the original read lock is never released and\nthus deadlock.\n\nThis series works around this by #ifndef CONFIG_ARM64\u0027ing the mmap read\nlock in vmap logic, then partially reverting commit fa93b45fd397 (\"arm64:\nEnable vmalloc-huge with ptdump\"), keeping the enablement of huge vmap\nsupport, and removing the ifdeffery with the partial revert patch.\n\nThere are related issues that are also addressed in this series:\n\n* x86 page attribute logic, specifically Change Page Attributes (CPA),\n implements a feature whereby huge ranges can be collapsed into huge leaf\n entries. This can similarly cause a UAF when done in parallel with a\n ptdump walk, so similarly acquire the init_mm mmap lock to avoid this.\n\n* The CPA logic allows concurrent page table manipulation and CPA\n collapse, meaning the former risks accessing a page table the latter\n frees. Fix this by acquiring mmap write lock on init_mm across the\n whole CPA collapse operation and read lock on the page table\n manipulation.\n\n* x86 and arm64 permit walks of non-kernel mm\u0027s (both allowing efi mm\n walks, and in x86\u0027s case arbitrary mm\u0027s), so we ensure kernel mappings\n remain stable by locking the init_mm as well as the mm being walked.\n\nThe ordering of patches is established for both strict dependencies (the\narm64 partial revert in particular has to be done after the vmap changes)\nand logical ones (the non-kernel mm fix only makes sense once the vmap/CPA\nfixes are in place).\n\n\nThis patch (of 3):\n\nCurrently there is a nasty ra\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:47:58.392Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/39c6772b56a6bbdd62794833f74232971d94d7c9"
},
{
"url": "https://git.kernel.org/stable/c/8d7f560f4b0482d469de962fbe4b59c37561052e"
},
{
"url": "https://git.kernel.org/stable/c/7ac8a333dd41ba5e1b4e8c6edbc48b15446c5468"
},
{
"url": "https://git.kernel.org/stable/c/c5bf8cd148cfea948cfa3db71da427294b20db0f"
},
{
"url": "https://git.kernel.org/stable/c/3cc26c8907db0f5d1ff8043b5851ee572e9b3c98"
},
{
"url": "https://git.kernel.org/stable/c/26444eb71465c9934d9d418ef69c43f61185329b"
}
],
"title": "mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74672",
"datePublished": "2026-08-22T15:32:42.210Z",
"dateReserved": "2026-08-15T05:44:03.925Z",
"dateUpdated": "2026-08-23T12:47:58.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74672",
"date": "2026-08-29",
"epss": "0.00173",
"percentile": "0.06789"
},
"microsoft_vex": {
"current_release_date": "2026-08-24T14:44:03.000Z",
"cve": "CVE-2026-74672",
"id": "msrc_CVE-2026-74672",
"initial_release_date": "2026-08-24T01:10:34.000Z",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74672.json",
"version": "2"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-74672\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:41.200\",\"lastModified\":\"2026-08-23T13:16:48.460\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF\\n\\nPatch series \\\"mm: fix UAF caused by race between ptdump and vmap pgtable\\nfreeing\\\", v6.\\n\\nKernel page table walkers fall into two broad categories - those ranges\\nwhere no exclusion is required via walk_kernel_page_table_range_lockless()\\nand those where exclusion is required via walk_kernel_page_table_range()\\nor walk_page_range_debug().\\n\\nThe former category is used only by arm64 arch code operating on ranges it\\nboth wholly owns and does not concurrently write.\\n\\nThe latter category consists of kernel page table walkers operating on\\nranges that are wholly owned (but which need exclusion against concurrent\\nwriters).\\n\\nThe lock used for exclusion is the mmap lock, and for kernel ranges this\\nis the mmap lock on init_mm.\\n\\nptdump is a special case being both the only user of\\nwalk_page_range_debug(), and the only case in which it walks ranges it\\ndoes not own.\\n\\nThis presents a problem, as page tables may be freed under ptdump. And\\nindeed there is a use-after-free bug in the kernel as a result, which this\\nseries addresses.\\n\\nvmap promotes page tables to huge leaf entries where possible, freeing the\\nlower page table when it does. It does this with no meaningful locks held\\nagainst concurrent ptdump walks.\\n\\nAs a result, use-after-free can currently occur. This series addresses\\nthe issue by having the vmap huge promotion logic acquire the mmap read\\nlock while both setting the huge page table entry and freeing the prior\\nleaf page table.\\n\\nThe ptdump code already acquires the mmap write lock, so by doing so we\\nensure that the ptdump walker only ever observes either the huge page\\ntable entry or the existing page table entry, and nothing is freed\\nunderneath it.\\n\\nA mitigation for this issue was already applied for arm64 in commit\\nfa93b45fd397 (\\\"arm64: Enable vmalloc-huge with ptdump\\\"), which this series\\nhas to deal with carefully.\\n\\nThis mitigation resolves the issue by acquiring the mmap read lock on\\ninit_mm on vmap page table free if a ptdump is in progress.\\n\\nHowever the fix in this series would cause a deadlock if we were to simply\\napply it for arm64 without also reverting the change.\\n\\nThis is because vmap may acquire the read lock before ptdump attempts to\\nacquire the write lock, which then gets queued, and rwsem starvation rules\\nmean that the (unacknowledged) nested mmap read lock in the arm64 code\\nwould also block, meaning the original read lock is never released and\\nthus deadlock.\\n\\nThis series works around this by #ifndef CONFIG_ARM64\u0027ing the mmap read\\nlock in vmap logic, then partially reverting commit fa93b45fd397 (\\\"arm64:\\nEnable vmalloc-huge with ptdump\\\"), keeping the enablement of huge vmap\\nsupport, and removing the ifdeffery with the partial revert patch.\\n\\nThere are related issues that are also addressed in this series:\\n\\n* x86 page attribute logic, specifically Change Page Attributes (CPA),\\n implements a feature whereby huge ranges can be collapsed into huge leaf\\n entries. This can similarly cause a UAF when done in parallel with a\\n ptdump walk, so similarly acquire the init_mm mmap lock to avoid this.\\n\\n* The CPA logic allows concurrent page table manipulation and CPA\\n collapse, meaning the former risks accessing a page table the latter\\n frees. Fix this by acquiring mmap write lock on init_mm across the\\n whole CPA collapse operation and read lock on the page table\\n manipulation.\\n\\n* x86 and arm64 permit walks of non-kernel mm\u0027s (both allowing efi mm\\n walks, and in x86\u0027s case arbitrary mm\u0027s), so we ensure kernel mappings\\n remain stable by locking the init_mm as well as the mm being walked.\\n\\nThe ordering of patches is established for both strict dependencies (the\\narm64 partial revert in particular has to be done after the vmap changes)\\nand logical ones (the non-kernel mm fix only makes sense once the vmap/CPA\\nfixes are in place).\\n\\n\\nThis patch (of 3):\\n\\nCurrently there is a nasty ra\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/mmap_lock.h\",\"mm/pagewalk.c\",\"mm/vmalloc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e\",\"lessThan\":\"39c6772b56a6bbdd62794833f74232971d94d7c9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e\",\"lessThan\":\"8d7f560f4b0482d469de962fbe4b59c37561052e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e\",\"lessThan\":\"7ac8a333dd41ba5e1b4e8c6edbc48b15446c5468\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e\",\"lessThan\":\"c5bf8cd148cfea948cfa3db71da427294b20db0f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e\",\"lessThan\":\"3cc26c8907db0f5d1ff8043b5851ee572e9b3c98\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e\",\"lessThan\":\"26444eb71465c9934d9d418ef69c43f61185329b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"31895cfd79564111cdd5a9f48c5d491ae26a238e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9c7f7bdb1932f8c1e5f80d32c717184701afe701\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"acdb4981644c8e31ccee294bdefff475c0cf587b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0454e2fad9306961540ee7e84da47a8e345b7d22\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.4.125\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.91\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.31\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.15.14\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/mmap_lock.h\",\"mm/pagewalk.c\",\"mm/vmalloc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.184\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.153\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/26444eb71465c9934d9d418ef69c43f61185329b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/39c6772b56a6bbdd62794833f74232971d94d7c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3cc26c8907db0f5d1ff8043b5851ee572e9b3c98\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7ac8a333dd41ba5e1b4e8c6edbc48b15446c5468\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8d7f560f4b0482d469de962fbe4b59c37561052e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c5bf8cd148cfea948cfa3db71da427294b20db0f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-24T16:49:51+00:00",
"cve": "CVE-2026-74672",
"id": "CVE-2026-74672",
"initial_release_date": "2026-08-22T00:00:00+00:00",
"product_status:known_affected": "246",
"product_status:known_not_affected": "28",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74672.json",
"version": "3"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…