CVE-2026-74629— net/dibs: Correct freeing of dmb_clientid_arr
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，已修复以下漏洞： net/dibs: 正确释放 dmb_clientid_arr dibs 设备的中断处理程序可能在 执行后仍处于活跃状态，并可能继续访问 ，从而引发使用已释放内存（UAF, Use-After-Free）漏洞。 另外，当由 调用的 发生失败时， 会被释放两次（double free）。 修复方案：在最后一个引用释放后，于 中释放 。 需注意：目前将 的分配操作放在 而非 中是可以接受的，因为在调用 之前，不会有其他 dmbs 被注册。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1068 · Exploitation for Privilege EscalationAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | cc21191b584c6f7836b0f10774f8278b7cbfba10< ece6426b61241e9bfb41aa131f235168f55229b1 |
affected |
cc21191b584c6f7836b0f10774f8278b7cbfba10< 7a1df20a8d2cc89e3a442b6e0b43b1cacde8d403 |
affected | ||
cc21191b584c6f7836b0f10774f8278b7cbfba10< 9e6869be49064915edb6c8776b27c376cfdb0df5 |
affected | ||
6.18 |
affected | ||
< 6.18 |
unaffected | ||
6.18.45≤ 6.18.* |
unaffected | ||
7.1.9≤ 7.1.* |
unaffected | ||
7.2≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-74629
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net/dibs: Correct freeing of dmb_clientid_arr
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net/dibs: Correct freeing of dmb_clientid_arr
A dibs device interrupt handler can be active after dibs_dev_del() and
may still access dmb_clientid_arr. (UAF)
In case of a failure in dibs_dev_add() being called by dibs_lo_dev_probe()
dmb_clientid_arr is freed twice (double free).
Free dmb_clientid_arr in dibs_dev_release() after last reference is gone.
Note that allocating in dibs_dev_add() instead of dibs_dev_alloc() is ok
for now, because no dmbs can be registered before dibs_dev_add().
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-74629
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74629
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-74629 (2)
Same Patch Batch · Linux · 2026-08-22 · 150 CVEs total
| CVE-2026-74705 | 10.0 CRITICAL | udp: fix potential use-after-free in tunnel segmentation |
| CVE-2026-74612 | 10.0 CRITICAL | veth: fix skb length accounting after XDP frag adjustment |
| CVE-2026-74587 | 9.8 CRITICAL | sctp: fix use-after-free of cached ASCONF chunk |
| CVE-2026-74591 | 9.8 CRITICAL | mm/filemap: __filemap_add_folio() restore index before retrying |
| CVE-2026-74688 | 9.8 CRITICAL | sctp: clear control chunk transport if it is being removed |
| CVE-2026-74597 | 9.8 CRITICAL | ip6_tunnel: clear skb2->cb[] in ip6ip6_err() |
| CVE-2026-74617 | 9.8 CRITICAL | dibs: initialise dibs->lock in dibs_dev_alloc() |
| CVE-2026-74616 | 9.8 CRITICAL | xdp: reject clones that overrun skb_shared_info tailroom |
| CVE-2026-74628 | 9.8 CRITICAL | net/x25: fix use-after-free of the socket by its timers |
| CVE-2026-74608 | 9.8 CRITICAL | smb: client: Fix use-after-free in cifs_try_adding_channels() |
| CVE-2026-74669 | 9.8 CRITICAL | ipvs: clear IPv4 options after rebasing tunnel ICMP errors |
| CVE-2026-74662 | 9.8 CRITICAL | inet: frags: publish queues before arming timer |
| CVE-2026-74730 | 9.8 CRITICAL | NFS: Pin the 'struct nfs_server' during a FREE_STATEID call |
| CVE-2026-74727 | 9.8 CRITICAL | ovpn: skip rehash for peers already removed from by_id |
| CVE-2026-74586 | 9.8 CRITICAL | sctp: clear new_transport when removing a peer |
| CVE-2026-74723 | 9.8 CRITICAL | btrfs: lzo: reject inline extents without valid headers |
| CVE-2026-74588 | 9.8 CRITICAL | sctp: keep chunk->transport in step with the list it is queued on |
| CVE-2026-74611 | 9.8 CRITICAL | tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| CVE-2026-74712 | 9.3 CRITICAL | vdpa/mlx5: Fix buffer length in create_direct_keys() |
| CVE-2026-74665 | 9.1 CRITICAL | net: fix skb length accounting after generic XDP frag adjustment |
Showing top 20 of 150 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-74733
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock -
CVE-2026-74732
drm/amd/display: Check for tg ops in dce110_set_avmute -
CVE-2026-74731
sched_ext: Skip sub-disable teardown for never-linked sub-sc -
CVE-2026-74730
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call -
CVE-2026-74729
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_
Same vendor: Linux
-
CVE-2026-74733
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock -
CVE-2026-74732
drm/amd/display: Check for tg ops in dce110_set_avmute -
CVE-2026-74731
sched_ext: Skip sub-disable teardown for never-linked sub-sc -
CVE-2026-74730
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call -
CVE-2026-74729
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_
V. Comments for CVE-2026-74629
No comments yet