CVE-2026-74629

net/dibs: Correct freeing of dmb_clientid_arr

State: Published
Severity: 8.8 High
Published: Aug 22, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/dibs: Correct freeing of dmb_clientid_arr

A dibs device interrupt handler can be active after dibs_dev_del() and may still access dmb_clientid_arr. (UAF)

In case of a failure in dibs_dev_add() being called by dibs_lo_dev_probe() dmb_clientid_arr is freed twice (double free).

Free dmb_clientid_arr in dibs_dev_release() after last reference is gone. Note that allocating in dibs_dev_add() instead of dibs_dev_alloc() is ok for now, because no dmbs can be registered before dibs_dev_add().

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	cc21191b584c6f7836b0f10774f8278b7cbfba10 to before ece6426b61241e9bfb41aa131f235168f55229b1Affected cc21191b584c6f7836b0f10774f8278b7cbfba10 to before 7a1df20a8d2cc89e3a442b6e0b43b1cacde8d403Affected cc21191b584c6f7836b0f10774f8278b7cbfba10 to before 9e6869be49064915edb6c8776b27c376cfdb0df5Affected
LinuxLinux	6.18Affected before 6.18Not affected 6.18.45 through 6.18.Not affected 7.1.9 through 7.1.Not affected 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.