CVE-2026-74514 Linux CVE debrief

Who should care

Linux system administrators, KVM s390 pci module users, and organizations relying on Linux kernel-based infrastructure, particularly those with deployments using the Linux kernel, should be aware of this vulnerability and take necessary actions to mitigate potential risks. Those responsible for maintaining and securing Linux-based systems, especially in environments utilizing KVM s390 pci module, need to assess their exposure and apply appropriate patches or updates. Furthermore, security teams and vulnerability management teams should prioritize this issue due to its potential impact on system security and stability.

Technical summary

The CVE-2026-74514 vulnerability involves a memory accounting issue in the KVM s390 pci module of the Linux kernel. The account_mem() and unaccount_mem() functions call get_uid(), which increments the reference count of struct user_struct on every invocation, but the count is not decremented by calling free_uid(). Additionally, pages are accounted/unaccounted against the current->mm, but it's possible that unaccount_mem() can be called from a different process context than the one that originally pinned the pages. To fix this, the pinning process user_struct and mm_struct are stored when accounting for pinned pages, and these resources are freed when the pages are unpinned.

Defensive priority

This vulnerability affects the Linux kernel, specifically the KVM s390 pci module, and could potentially allow for memory corruption or privilege escalation.

Recommended defensive actions

• Inventory Linux systems using KVM s390 pci module and assess for exposure.
• Apply kernel updates or patches provided by the Linux distribution.
• Monitor system logs for unusual memory allocation patterns.
• Implement compensating controls such as memory access controls.
• Exception tracking for systems with KVM s390 pci module.

Evidence notes

The CVE-2026-74514 vulnerability involves a memory accounting issue in the KVM s390 pci module of the Linux kernel. The account_mem() and unaccount_mem() functions call get_uid(), which increments the reference count of struct user_struct on every invocation, but the count is not decremented by calling free_uid(). Additionally, pages are accounted/unaccounted against the current->mm, but it's possible that unaccount_mem() can be called from a different process context than the one that originally pinned the pages. To fix this, the pinning process user_struct and mm_struct are stored when accounting for pinned pages, and these resources are freed when the pages are unpinned.

Official resources