CVE-2026-74690

A flaw was found in the Linux kernel's s390/ism component. An interrupt handler could concurrently access data structures (sba and ieq) that have already been freed during the ism_dev_exit() process. This Use-After-Free (UAF) vulnerability could lead to system instability or potentially allow for privilege escalation.

A race in the s390 ISM driver can allow an interrupt handler to run in parallel with ism_dev_exit while sba and ieq data structures are being released. This creates a use after free condition in the interrupt path because an already active handler may still access those objects after they are freed. For the CVSS the PR:L in the paranoid vector represents an attacker or service account that can trigger driver unbind, reset, module unload, or device teardown through delegated administration rather than full host root. The issue is not directly network reachable and requires local control over the affected device lifecycle or a closely related management path. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel memory corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.