CVE-2026-74514: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
The accountmem() and unaccountmem() functions call getuid() which increments the reference count of struct userstruct on every invocation. But we don't decrement the count by calling freeuid(). It also accounted/unaccounted the pages against the current->mm. But its possible the unaccountmem() can be called from a different process context than the one that originally pinned the pages.
Let's fix this by storing the pinning process userstruct and mmstruct when accounting for pinned pages, and subsequently free these resources when the pages are unpinned.
[borntraeger@linux.ibm.com: Fixed whitespace]
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74514?
CVE-2026-74514 has a risk rating of 27, indicating a significant security concern.
How do I fix CVE-2026-74514?
Upgrading to the latest version of the Linux kernel that addresses CVE-2026-74514 resolves the vulnerability.
What systems are affected by CVE-2026-74514?
CVE-2026-74514 affects the Linux kernel, specifically environments using KVM with s390 architecture.
What is the impact of CVE-2026-74514?
The vulnerability can lead to improper memory accounting, potentially enabling resource misallocation or denial of service.
When was CVE-2026-74514 published?
CVE-2026-74514 was published on August 15, 2026.