CVE-2026-74629: net/dibs: Correct freeing of dmb_clientid_arr
In the Linux kernel, the following vulnerability has been resolved:
net/dibs: Correct freeing of dmbclientidarr
A dibs device interrupt handler can be active after dibsdevdel() and may still access dmbclientidarr. (UAF)
In case of a failure in dibsdevadd() being called by dibslodevprobe() dmbclientidarr is freed twice (double free).
Free dmbclientidarr in dibsdevrelease() after last reference is gone. Note that allocating in dibsdevadd() instead of dibsdevalloc() is ok for now, because no dmbs can be registered before dibsdevadd().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Free dmb_clientid_arr in dibs_dev_release() only after the last reference is gone, ensuring a dibs device interrupt handler can no longer access it and preventing double-free on dibs_dev_add() failure.
Event History
Frequently Asked Questions
Under what conditions can this issue be triggered?
The use-after-free condition requires a dibs device interrupt handler to remain active after dibs_dev_del() and access dmb_clientid_arr. A separate double-free condition can occur when dibs_dev_add(), called by dibs_lo_dev_probe(), fails.
What is the relevant mitigation if an update cannot be applied immediately?
The provided information does not identify a configuration workaround. Reducing exposure would require avoiding the affected dibs device removal path while an interrupt handler may still be active, and avoiding the dibs_lo_dev_probe() failure path where possible.
How can I determine whether a system is affected?
Check whether the running Linux kernel includes one of the referenced stable fixes. The issue concerns net/dibs code paths involving dibs_dev_del(), dibs_dev_add(), dibs_lo_dev_probe(), and dmb_clientid_arr.