CVE-2026-74672

A flaw was found in the Linux kernel. This vulnerability involves a use-after-free (UAF) error in the memory management subsystem, specifically during operations related to virtual memory (vmalloc) and page table dumping (ptdump). A race condition can occur when the kernel attempts to free page tables while they are still being accessed by ptdump or when collapsing huge page ranges using Change Page Attributes (CPA) logic. This can lead to a use-after-free condition, which may result in system instability or potentially allow for privilege escalation or arbitrary code execution.

ptdump can walk kernel page tables it does not own while vmap huge mapping promotion can replace a lower level page table with a huge P4D PUD or PMD entry and free the old table. A race between these paths can let ptdump access a freed page table, resulting in use-after-free, memory corruption, or a kernel crash. For the CVSS the PR:L is used for the paranoid score because reliable triggering may be possible from a local user or less privileged service context if ptdump or related debug page table walking is exposed or invoked in the environment. The issue is not directly network reachable and requires local activity plus a timing window, so AC:H is appropriate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.