CVE-2026-74517 Linux kernel CVE debrief

Who should care

System administrators and security teams responsible for Linux kernel-based systems, particularly those using KVM for virtualization, should be aware of this vulnerability and take steps to mitigate it. These teams should review their system's exposure, apply patches or mitigations, and monitor for suspicious activity related to KVM and I/O APIC operations. Additionally, they should consider implementing compensating controls, such as restricting access to KVM and I/O APIC functionality, and track exceptions and retest remediated assets to ensure the vulnerability is properly addressed. The vulnerability can be mitigated by applying the patch to cancel delayed I/O APIC EOI handling before destroying vCPUs and by monitoring for suspicious activity related to KVM and I/O APIC operations. System administrators should also consider implementing compensating controls, such as restricting access to KVM and I/O APIC functionality, and track exceptions and retest remediated assets to ensure the vulnerability is properly addressed. This should be done in conjunction with reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Compensating controls should be reviewed and verified to ensure they are effective in mitigating the vulnerability. Monitoring and detection capabilities should be checked for exposed assets that need extra review. Exceptions should be tracked, and remediated assets should be retested and verified before closing the item. This process should be done in accordance with standard change control procedures and with the goal of minimizing potential disruptions to system operations. It is also essential to review and update incident response plans to address potential exploitation of this vulnerability. This includes identifying and training personnel responsible for responding to security incidents, as well as ensuring that incident response procedures are in place and tested regularly. By taking these steps, system administrators and security teams can help mitigate the risk associated with this vulnerability and ensure the security and stability of their systems. The vulnerability can be mitigat

Technical summary

The vulnerability occurs in the Linux kernel's KVM subsystem, specifically in the handling of I/O APIC's delayed EOI. When the delayed work is processed after vCPUs are destroyed, it leads to a use-after-free error. The issue is resolved by canceling the delayed work during the 'pre VM destroy' phase. This fix prevents the use-after-free error and ensures the stability of the system. The vulnerability was identified through a KASAN report, which detected a slab-use-after-free error in the __kvm_irq_delivery_to_apic_fast function.

Defensive priority

High

Recommended defensive actions

• Inventory and assess Linux kernel-based systems for potential exposure to this vulnerability.
• Apply the patch to cancel delayed I/O APIC EOI handling before destroying vCPUs.
• Monitor for suspicious activity related to KVM and I/O APIC operations.
• Consider implementing compensating controls, such as restricting access to KVM and I/O APIC functionality.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The vulnerability was resolved by canceling the I/O APIC's delayed EOI handling work during the 'pre VM destroy' phase, before vCPUs are destroyed. The issue was identified through a KASAN report, which detected a slab-use-after-free error in the __kvm_irq_delivery_to_apic_fast function.

Official resources