CVE-2026-74629

A flaw was found in the Linux kernel's dibs device handling. A use-after-free (UAF) vulnerability exists where a dibs device interrupt handler can access dmb_clientid_arr after it has been freed. Additionally, a double-free vulnerability can occur if dibs_dev_add() fails during dibs_lo_dev_probe(), leading to dmb_clientid_arr being freed twice. These issues could potentially lead to system instability or denial of service.

A use after free is possible in the DIBS device lifetime path because dmb_clientid_arr could be freed in dibs_dev_del while an interrupt handler may still access it after device deletion. A related error path in dibs_lo_dev_probe could also free the same array twice when dibs_dev_add fails, which makes this a memory lifetime issue rather than a simple leak. For the CVSS the PR:L is used in the paranoid score because a local actor with delegated device or driver control, such as a service account or reduced capability administrator, may be able to trigger add or delete paths without full host root privileges. The issue is not directly network reachable based on the patch context. Impact is at least denial of service via crash and in the worst case may allow confidentiality or integrity impact due to use after free or double free memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.