CVE-2026-74482 (GCVE-0-2026-74482)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:37
VLAI
Title
mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios __folio_split() keeps dereferencing the mapping after the split: shmem_uncharge(mapping->host) and remap_page() while the folios are still frozen/locked, and i_mmap_unlock_read(mapping) at the very end, after the after-split folios have been unlocked and freed. Nothing holds an inode reference across that. The split relies on @folio -- which the beyond-EOF drop loop never removes, as it starts at folio_next(folio) -- staying locked and in the page cache to hold off eviction. But the unlock loop unlocks @folio before i_mmap_unlock_read() runs. If the caller's @lock_at is a tail beyond EOF, as memory_failure() passes when splitting a poisoned tail of a shmem THP that reaches past i_size during truncation, it too is gone from the page cache; so once @folio is unlocked no locked, in-cache folio pins the inode, and a concurrent final iput() can evict and RCU-free it before i_mmap_unlock_read() touches i_mmap_rwsem: BUG: KASAN: slab-use-after-free in __up_read+0x634/0x790 i_mmap_unlock_read include/linux/fs.h:537 [inline] __folio_split+0x732/0x1640 mm/huge_memory.c:4100 try_to_split_thp_page+0xab/0x390 mm/memory-failure.c:1675 memory_failure+0x1394/0x26e0 mm/memory-failure.c:2470 Freed by task 4601: shmem_free_in_core_inode+0x54/0xb0 mm/shmem.c:5177 evict+0x57f/0xac0 fs/inode.c:870 Do every mapping dereference while @folio still pins the inode: drop i_mmap_rwsem right after remap_page(), before the loop that unlocks and frees the after-split folios, and clear @mapping so the exit path does not unlock it again. shmem_uncharge() and remap_page() already run before that point, so after this nothing past the unlock loop touches the inode or the mapping. This is now a rule the split depends on, alongside keeping @folio frozen until the page cache is updated: no inode or mapping dereference once the after-split folios start being unlocked.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: baa355fd331424526e742d41d9b90d5f9d10f716 , < bc2f5eabaaf60ec18da70b619a8fba1bfb7dea3a (git)
Affected: baa355fd331424526e742d41d9b90d5f9d10f716 , < f87c08060818ebb19bafed37c38244538da25097 (git)
Affected: baa355fd331424526e742d41d9b90d5f9d10f716 , < 6f5c272d71845a669e4c8ee5c72b376e29a0e6e5 (git)
Affected: baa355fd331424526e742d41d9b90d5f9d10f716 , < be106f7855f03d3128ed0ce70ba74b484a90b473 (git)
Affected: baa355fd331424526e742d41d9b90d5f9d10f716 , < e3dd774dbfd0b5bc2dbd0995221751b1234f8205 (git)
Affected: baa355fd331424526e742d41d9b90d5f9d10f716 , < 10065fb891651d9541e7a5a2db84c1e656ece4f9 (git)
Affected: baa355fd331424526e742d41d9b90d5f9d10f716 , < d640efe94d86d3be893d4c19220362546a637e90 (git)
Affected: baa355fd331424526e742d41d9b90d5f9d10f716 , < e923bd21058ea02fd0dcd3549d151d143fd036e5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.8
Unaffected: 0 , < 4.8 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/huge_memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bc2f5eabaaf60ec18da70b619a8fba1bfb7dea3a",
              "status": "affected",
              "version": "baa355fd331424526e742d41d9b90d5f9d10f716",
              "versionType": "git"
            },
            {
              "lessThan": "f87c08060818ebb19bafed37c38244538da25097",
              "status": "affected",
              "version": "baa355fd331424526e742d41d9b90d5f9d10f716",
              "versionType": "git"
            },
            {
              "lessThan": "6f5c272d71845a669e4c8ee5c72b376e29a0e6e5",
              "status": "affected",
              "version": "baa355fd331424526e742d41d9b90d5f9d10f716",
              "versionType": "git"
            },
            {
              "lessThan": "be106f7855f03d3128ed0ce70ba74b484a90b473",
              "status": "affected",
              "version": "baa355fd331424526e742d41d9b90d5f9d10f716",
              "versionType": "git"
            },
            {
              "lessThan": "e3dd774dbfd0b5bc2dbd0995221751b1234f8205",
              "status": "affected",
              "version": "baa355fd331424526e742d41d9b90d5f9d10f716",
              "versionType": "git"
            },
            {
              "lessThan": "10065fb891651d9541e7a5a2db84c1e656ece4f9",
              "status": "affected",
              "version": "baa355fd331424526e742d41d9b90d5f9d10f716",
              "versionType": "git"
            },
            {
              "lessThan": "d640efe94d86d3be893d4c19220362546a637e90",
              "status": "affected",
              "version": "baa355fd331424526e742d41d9b90d5f9d10f716",
              "versionType": "git"
            },
            {
              "lessThan": "e923bd21058ea02fd0dcd3549d151d143fd036e5",
              "status": "affected",
              "version": "baa355fd331424526e742d41d9b90d5f9d10f716",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/huge_memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios\n\n__folio_split() keeps dereferencing the mapping after the split:\nshmem_uncharge(mapping-\u003ehost) and remap_page() while the folios are still\nfrozen/locked, and i_mmap_unlock_read(mapping) at the very end, after the\nafter-split folios have been unlocked and freed.\n\nNothing holds an inode reference across that.  The split relies on @folio\n-- which the beyond-EOF drop loop never removes, as it starts at\nfolio_next(folio) -- staying locked and in the page cache to hold off\neviction.  But the unlock loop unlocks @folio before i_mmap_unlock_read()\nruns.  If the caller\u0027s @lock_at is a tail beyond EOF, as memory_failure()\npasses when splitting a poisoned tail of a shmem THP that reaches past\ni_size during truncation, it too is gone from the page cache; so once\n@folio is unlocked no locked, in-cache folio pins the inode, and a\nconcurrent final iput() can evict and RCU-free it before\ni_mmap_unlock_read() touches i_mmap_rwsem:\n\n  BUG: KASAN: slab-use-after-free in __up_read+0x634/0x790\n   i_mmap_unlock_read include/linux/fs.h:537 [inline]\n   __folio_split+0x732/0x1640 mm/huge_memory.c:4100\n   try_to_split_thp_page+0xab/0x390 mm/memory-failure.c:1675\n   memory_failure+0x1394/0x26e0 mm/memory-failure.c:2470\n\n  Freed by task 4601:\n   shmem_free_in_core_inode+0x54/0xb0 mm/shmem.c:5177\n   evict+0x57f/0xac0 fs/inode.c:870\n\nDo every mapping dereference while @folio still pins the inode: drop\ni_mmap_rwsem right after remap_page(), before the loop that unlocks and\nfrees the after-split folios, and clear @mapping so the exit path does not\nunlock it again.  shmem_uncharge() and remap_page() already run before\nthat point, so after this nothing past the unlock loop touches the inode\nor the mapping.\n\nThis is now a rule the split depends on, alongside keeping @folio frozen\nuntil the page cache is updated: no inode or mapping dereference once the\nafter-split folios start being unlocked."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in __folio_split() on the memory_failure()-\u003etry_to_split_thp_page() path while splitting file-backed shmem THPs; reachability is via local syscalls (memfd/mmap/madvise/ftruncate) or admin hwpoison injection, not network or physical interfaces.\nAC:L - An attacker can deterministically create a shmem THP with tail pages beyond EOF and race MADV_HWPOISON-driven memory_failure() against concurrent truncate/close(iput) using attacker-controlled threads; both sides of the race are attacker-driven.\nPR:L - Reliable exploitation uses MADV_HWPOISON to invoke memory_failure() on a chosen tail page; CAP_SYS_ADMIN is available to user-namespace/container root, and the shmem THP setup needs only ordinary local mapping and truncation privileges.\nUI:N - No separate victim action is required; the attacker creates, maps, poisons, and truncates their own memfd/shmem/tmpfs object to reach the vulnerable split path.\nS:U - Impact is a kernel slab use-after-free on inode/mapping metadata in core MM within the same kernel security domain, not a VM escape, sandbox breakout, or other cross-authority boundary violation.\nC:H - KASAN reports slab-use-after-free in i_mmap_unlock_read() after shmem_free_in_core_inode() RCU-frees the inode; this inode/mapping UAF can be heap-sprayed into an arbitrary kernel memory read primitive.\nI:H - The same UAF corrupts freed inode slab objects and i_mmap_rwsem state, enabling heap grooming for arbitrary kernel writes and potential privilege escalation via control-flow hijacking per kernel UAF guidance.\nA:H - The use-after-free provokes a KASAN BUG/oops during i_mmap_unlock_read() and corrupts core MM inode state, capable of kernel panic or hang when triggered on production shmem/tmpfs workloads."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:37:38.544Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bc2f5eabaaf60ec18da70b619a8fba1bfb7dea3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f87c08060818ebb19bafed37c38244538da25097"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f5c272d71845a669e4c8ee5c72b376e29a0e6e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/be106f7855f03d3128ed0ce70ba74b484a90b473"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3dd774dbfd0b5bc2dbd0995221751b1234f8205"
        },
        {
          "url": "https://git.kernel.org/stable/c/10065fb891651d9541e7a5a2db84c1e656ece4f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d640efe94d86d3be893d4c19220362546a637e90"
        },
        {
          "url": "https://git.kernel.org/stable/c/e923bd21058ea02fd0dcd3549d151d143fd036e5"
        }
      ],
      "title": "mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74482",
    "datePublished": "2026-08-15T12:27:15.083Z",
    "dateReserved": "2026-08-15T05:44:03.904Z",
    "dateUpdated": "2026-08-19T16:37:38.544Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74482",
      "date": "2026-09-21",
      "epss": "0.00126",
      "percentile": "0.02591"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:53:46.000Z",
      "cve": "CVE-2026-74482",
      "id": "msrc_CVE-2026-74482",
      "initial_release_date": "2026-08-23T14:50:45.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74482.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "mm/huge_memory.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "bc2f5eabaaf60ec18da70b619a8fba1bfb7dea3a",
                    "status": "affected",
                    "version": "baa355fd331424526e742d41d9b90d5f9d10f716",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f87c08060818ebb19bafed37c38244538da25097",
                    "status": "affected",
                    "version": "baa355fd331424526e742d41d9b90d5f9d10f716",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6f5c272d71845a669e4c8ee5c72b376e29a0e6e5",
                    "status": "affected",
                    "version": "baa355fd331424526e742d41d9b90d5f9d10f716",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "be106f7855f03d3128ed0ce70ba74b484a90b473",
                    "status": "affected",
                    "version": "baa355fd331424526e742d41d9b90d5f9d10f716",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e3dd774dbfd0b5bc2dbd0995221751b1234f8205",
                    "status": "affected",
                    "version": "baa355fd331424526e742d41d9b90d5f9d10f716",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "10065fb891651d9541e7a5a2db84c1e656ece4f9",
                    "status": "affected",
                    "version": "baa355fd331424526e742d41d9b90d5f9d10f716",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d640efe94d86d3be893d4c19220362546a637e90",
                    "status": "affected",
                    "version": "baa355fd331424526e742d41d9b90d5f9d10f716",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e923bd21058ea02fd0dcd3549d151d143fd036e5",
                    "status": "affected",
                    "version": "baa355fd331424526e742d41d9b90d5f9d10f716",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "mm/huge_memory.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.8"
                  },
                  {
                    "lessThan": "4.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios\n\n__folio_split() keeps dereferencing the mapping after the split:\nshmem_uncharge(mapping-\u003ehost) and remap_page() while the folios are still\nfrozen/locked, and i_mmap_unlock_read(mapping) at the very end, after the\nafter-split folios have been unlocked and freed.\n\nNothing holds an inode reference across that.  The split relies on @folio\n-- which the beyond-EOF drop loop never removes, as it starts at\nfolio_next(folio) -- staying locked and in the page cache to hold off\neviction.  But the unlock loop unlocks @folio before i_mmap_unlock_read()\nruns.  If the caller\u0027s @lock_at is a tail beyond EOF, as memory_failure()\npasses when splitting a poisoned tail of a shmem THP that reaches past\ni_size during truncation, it too is gone from the page cache; so once\n@folio is unlocked no locked, in-cache folio pins the inode, and a\nconcurrent final iput() can evict and RCU-free it before\ni_mmap_unlock_read() touches i_mmap_rwsem:\n\n  BUG: KASAN: slab-use-after-free in __up_read+0x634/0x790\n   i_mmap_unlock_read include/linux/fs.h:537 [inline]\n   __folio_split+0x732/0x1640 mm/huge_memory.c:4100\n   try_to_split_thp_page+0xab/0x390 mm/memory-failure.c:1675\n   memory_failure+0x1394/0x26e0 mm/memory-failure.c:2470\n\n  Freed by task 4601:\n   shmem_free_in_core_inode+0x54/0xb0 mm/shmem.c:5177\n   evict+0x57f/0xac0 fs/inode.c:870\n\nDo every mapping dereference while @folio still pins the inode: drop\ni_mmap_rwsem right after remap_page(), before the loop that unlocks and\nfrees the after-split folios, and clear @mapping so the exit path does not\nunlock it again.  shmem_uncharge() and remap_page() already run before\nthat point, so after this nothing past the unlock loop touches the inode\nor the mapping.\n\nThis is now a rule the split depends on, alongside keeping @folio frozen\nuntil the page cache is updated: no inode or mapping dereference once the\nafter-split folios start being unlocked."
          }
        ],
        "id": "CVE-2026-74482",
        "lastModified": "2026-08-19T17:21:05.477",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:17:53.053",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/10065fb891651d9541e7a5a2db84c1e656ece4f9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6f5c272d71845a669e4c8ee5c72b376e29a0e6e5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bc2f5eabaaf60ec18da70b619a8fba1bfb7dea3a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/be106f7855f03d3128ed0ce70ba74b484a90b473"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d640efe94d86d3be893d4c19220362546a637e90"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e3dd774dbfd0b5bc2dbd0995221751b1234f8205"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e923bd21058ea02fd0dcd3549d151d143fd036e5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f87c08060818ebb19bafed37c38244538da25097"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T17:46:13+00:00",
      "cve": "CVE-2026-74482",
      "id": "CVE-2026-74482",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74482.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-18T00:26:51Z",
      "cve": "CVE-2026-74482",
      "id": "CVE-2026-74482",
      "initial_release_date": "2026-08-15T23:52:04Z",
      "product_status:first_fixed": "23",
      "product_status:known_affected": "713",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74482",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74482.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.