CVE-2026-74352

A flaw was found in the Linux kernel's reserved memory management. During initialization, if the allocation of the reserved memory array fails, a global pointer may still reference the freed memory. A subsequent operation, such as looking up reserved memory, could then attempt to access this freed memory, leading to a use-after-free vulnerability. This could result in system instability or a denial of service.

A post-init use-after-free can occur in the OF reserved memory code when alloc_reserved_mem_array() fails during boot. The global reserved_mem pointer may still reference the initial reserved_mem_array stored in __initdata, while reserved_mem_count remains nonzero. After init memory is freed, later calls to exported of_reserved_mem_lookup() can dereference freed memory and may crash the kernel or return corrupted reserved memory information. For the CVSS the PR:H value is used because reliable triggering normally requires control over boot time device tree or platform configuration, or conditions that make early memblock allocation fail. The issue is not network reachable and depends on local or platform level control rather than packet traffic. Impact is at least denial of service via kernel crash. In the paranoid score, confidentiality and integrity are raised because the bug class is use-after-free in kernel memory, so stale initdata reuse could theoretically affect lookup results or memory ownership decisions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.