CVE-2026-74574: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-74574 is a deadlock and use-after-free vulnerability in the Linux kernel's dmaengine: idxd driver, specifically within the idxd_cdev_open() function during file-device setup failure cleanup. The flaw was published on August 15, 2026, and affects Linux kernel versions starting from 6.4 up to (but not including) the fixed releases. Fixed versions include 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. The CVSS base score is currently 0.0 (no severity rating assigned), and Feedly estimates it as Medium severity (GitHub Advisory, Feedly).

The root cause is improper lock management (related to CWE-667: Improper Locking) combined with a use-after-free condition (CWE-416) in the idxd_cdev_open() error handling paths. Specifically, the failed_dev_add and failed_dev_name error paths call put_device(fdev) while still holding the wq->wq_lock spinlock; if this drops the last reference, idxd_file_dev_release() runs synchronously and attempts to re-acquire the same spinlock, causing a deadlock. Additionally, these error paths fall through to context cleanup labels owned by the release callback, causing idxd_xa_pasid_remove(ctx) and kfree(ctx) to operate on already-freed memory. The fix moves idxd_wq_get() before file-device setup, releases wq->wq_lock before calling put_device(fdev), and returns directly from the failure path to delegate cleanup to the release callback (GitHub Advisory).

A local user with permissions to open idxd character device files can trigger a kernel deadlock by initiating file-device setup operations that fail, causing the system to hang or become unresponsive (Denial of Service). The use-after-free condition may additionally result in memory corruption within the kernel context, though exploitation for privilege escalation has not been demonstrated. The impact is limited to availability, with no evidence of confidentiality or integrity compromise in current analysis (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability requires local access and specific permissions to open idxd character device files, significantly limiting the attack surface. It is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

Apply the upstream kernel patches that resolve the locking and use-after-free issues in idxd_cdev_open(). Fixed versions are: 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6 or later. As a workaround where patching is not immediately possible, restricting local user access to idxd character device files (e.g., via file permissions or SELinux/AppArmor policies) can reduce exposure. Kernel maintainers have backported fixes across multiple stable branches (GitHub Advisory, Kernel Patch 6.6, Kernel Patch 6.12).

The vulnerability received routine coverage from automated CVE tracking and aggregation services shortly after publication on August 15, 2026. A Reddit post in the r/pwnhub community included it in a daily CVE brief on August 16, 2026, with no notable discussion. No significant vendor statements or researcher commentary beyond the kernel patch itself have been identified (Feedly).