HIGH Introduced in 4.19
ism DevExit UAF
CVE-2026-74690
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ism_dev_exit() A ism interrupt handler can be active in parallel with ism_dev_exit(), accessing freed data structures. No new interrupts will be generated after unregister_ieq(). Drain ongoing interrupt handlers by free_irq(), before freeing ism data structures.
02KernelScan AI Analysis
Risk summary
A use-after-free in the s390 ISM (Internal Shared Memory) driver allows an interrupt handler to access DMA memory that has already been freed during device teardown. Exploitation requires s390 hardware with the ISM adapter and privileged local access to trigger device removal, combined with precise race timing. The bug can lead to kernel memory corruption, information disclosure, or a system crash.
Vulnerability analysis
During teardown of the internal shared memory adapter, the driver frees DMA memory that active interrupt handlers may still be accessing. Because those handlers can run in parallel with cleanup, this creates a use-after-free. The fix reorders teardown so the device is unregistered first to stop new interrupts, then the kernel waits for any ongoing handlers to finish before the memory is released. This only affects s390 systems with the affected adapter, and an attacker needs privileged local access to trigger device removal.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 4.19 | 6.12.114 | 58803870ba08 |
| 6.18 | 4.19 | 6.18.45 | fc3021284050 |
| 6.6 | 4.19 | 6.6.160 | 950dac9e8c4e |
| 7.1 | 4.19 | 7.1.9 | 774394d27930 |
| mainline | 4.19 | 7.2 | b1896543ce59 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |