CVE-2026-74690: s390/ism: Fix UAF of sba and ieq during ism_dev_exit()

Published Aug 22, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

s390/ism: Fix UAF of sba and ieq during ismdevexit()

A ism interrupt handler can be active in parallel with ismdevexit(), accessing freed data structures.

No new interrupts will be generated after unregisterieq(). Drain ongoing interrupt handlers by freeirq(), before freeing ism data structures.

Event History

Aug 22, 2026

CVE Published

via MITRE·03:32 PM

Data Sourced

via MITRE·03:32 PM

Description

Data Sourced

via NVD·04:16 PM

Description

Frequently Asked Questions

What systems are exposed to this issue?

Systems running the Linux kernel with the s390 ISM functionality in use are the relevant exposure scope. The race occurs during ISM device teardown in ism_dev_exit().

What condition is required for exploitation or impact?

An ISM interrupt handler must still be active while ism_dev_exit() frees the associated sba and ieq data structures. The issue is a use-after-free caused by concurrent interrupt handling and device exit.

How does the fix prevent the use-after-free?

The fix drains ongoing interrupt handlers with free_irq() before freeing ISM data structures. unregister_ieq() prevents new interrupts, while free_irq() ensures already-running handlers have completed.

CVE-2026-74690: s390/ism: Fix UAF of sba and ieq during ism_dev_exit()

Event History

Frequently Asked Questions

What systems are exposed to this issue?

What condition is required for exploitation or impact?

How does the fix prevent the use-after-free?

Company

Resources

Contact

Frequently Asked Questions

What systems are exposed to this issue?

What condition is required for exploitation or impact?

How does the fix prevent the use-after-free?