CVE-2026-74690: s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
In the Linux kernel, the following vulnerability has been resolved:
s390/ism: Fix UAF of sba and ieq during ismdevexit()
A ism interrupt handler can be active in parallel with ismdevexit(), accessing freed data structures.
No new interrupts will be generated after unregisterieq(). Drain ongoing interrupt handlers by freeirq(), before freeing ism data structures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.9-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.45 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.9 - Operational
During ism_dev_exit(), call unregister_ieq() so no new interrupts are generated, then drain ongoing ISM interrupt handlers with free_irq() before freeing the ISM data structures, including sba and ieq.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running the Linux kernel with the s390 ISM functionality in use are the relevant exposure scope. The race occurs during ISM device teardown in ism_dev_exit().
What condition is required for exploitation or impact?
An ISM interrupt handler must still be active while ism_dev_exit() frees the associated sba and ieq data structures. The issue is a use-after-free caused by concurrent interrupt handling and device exit.
How does the fix prevent the use-after-free?
The fix drains ongoing interrupt handlers with free_irq() before freeing ISM data structures. unregister_ieq() prevents new interrupts, while free_irq() ensures already-running handlers have completed.