Skip to content
Heist/ feed
UnratedFix available

CVE-2026-74672 affecting package kernel for versions less than 6.6.157.1-1

Type: advisorySource: OSV1 source record

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6. Kernel page table walkers fall into two broad categories - those ranges where no exclusion is required via walk_kernel_page_table_range_lockless() and those where exclusion is required via walk_kernel_page_table_range() or walk_page_range_debug(). The former category is used only by arm64 arch code operating on ranges it both wholly owns and does not concurrently write. The latter category consists of kernel page table walkers operating on ranges that are wholly owned (but which need exclusion against concurrent writers). The lock used for exclusion is the mmap lock, and for kernel ranges this is the mmap lock on init_mm. ptdump is a special case being both the only user of walk_page_range_debug(), and the only case in which it walks ranges it does not own. This presents a problem, as page tables may be freed under ptdump. And indeed there is a use-after-free bug in the kernel as a result, which this series addresses. vmap promotes page tables to huge leaf entries where possible, freeing the lower page table when it does. It does this with no meaningful locks held against concurrent ptdump walks. As a result, use-after-free can currently occur. This series addresses the issue by having the vmap huge promotion logic acquire the mmap read lock while both settin

Announced Group revision 1
Original source ↗

AZL-97292

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:AZL-97292

kernel

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
6.6.157.1-1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "6.6.157.1-1"
          }
        ]
      }
    ],
    "package": {
      "name": "kernel",
      "purl": "pkg:rpm/azure-linux/kernel",
      "ecosystem": "Azure Linux:3"
    },
    "database_specific": {
      "source": "https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-97292.json"
    }
  }
]
Related CVEs
CVE-2026-74672

Source reference: /upstream

Publisher severity

No explicit severity was provided.

Event
#68697 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement