CVE-2026-74313

A flaw was found in the Linux kernel's vduse component. A race condition in the vduse_dev_open() function allows a memory object to be freed while still in use. This use-after-free vulnerability could enable a local attacker to cause a system crash (denial of service) or potentially execute arbitrary code with elevated privileges.

This vulnerability is rated as having Moderate impact because exploitation requires local access and permissions to interact with the kernel's vDPA Device in Userspace (VDUSE) control interface, primarily resulting in a denial of service. Under default Red Hat Enterprise Linux configurations, the VDUSE driver is built as an optional kernel module that is not loaded automatically, and non-privileged users cannot manipulate or open device nodes. Consequently, exposure is limited to environments where the driver is explicitly loaded and untrusted local users have direct access to VDUSE devices.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.