CVE-2026-74482

A flaw was found in the Linux kernel's huge memory management (mm/huge_memory). A race condition exists in the __folio_split() function where the i_mmap_rwsem lock is released prematurely before all after-split folios are fully processed. This allows a concurrent operation to free the inode while subsequent memory management operations attempt to access it, leading to a use-after-free vulnerability. This can result in system instability or a denial of service.

A use-after-free can occur in __folio_split because the code may touch mapping and i_mmap_rwsem after after-split folios have been unlocked and freed. In the reported shmem THP memory_failure path, lock_at may point to a tail page beyond EOF that was already dropped from the page cache, so once the main folio is unlocked there may be no locked in-cache folio pinning the inode. A concurrent final iput can evict and RCU-free the inode before i_mmap_unlock_read(mapping) runs, leading to a slab use-after-free in __up_read. For the CVSS the PR:L is used for the paranoid score because a local user may be able to shape shmem THP and truncation state while the final trigger depends on a difficult memory_failure or hwpoison condition. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to UAF memory corruption, so this should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.