UBUNTU-CVE-2026-74690: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ismdevexit() A ism interrupt handler can be active in parallel with ismdevexit(), accessing freed data structures. No new interrupts will be generated after unregisterieq(). Drain ongoing interrupt handlers by freeirq(), before freeing ism data structures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Operational
During ism_dev_exit(), call unregister_ieq() and then free_irq() to drain ongoing ISM interrupt handlers before freeing ISM data structures; no new interrupts are generated after unregister_ieq().
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, ubuntu/linux-fips, ubuntu/linux-gcp-fips, and ubuntu/linux-realtime.
What does an attacker need to exploit this issue?
The severity vector indicates local access is required. It indicates no privileges or user interaction are required.
What could successful exploitation impact?
The severity vector rates confidentiality, integrity, and availability impact as high. The underlying issue is a use-after-free involving ISM data structures during device exit while an interrupt handler is still active.