CVE-2026-74514: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages

Received
AliasesUBUNTU-CVE-2026-74514DEBIAN-CVE-2026-74514
Published 15-08-2026Last modified 23-08-2026

Vulnerability summary

CVE-2026-74514 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11.9% of scored vulnerabilities.

Priority
Insufficient evidence

No CVSS vector published; no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.21%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 3
SUSE-SU-2026:5091-1USN-8959-1USN-8960-1

Timeline

  1. 15-08-2026
    PublishedVulnerability first disclosed.
  2. 23-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The account_mem() and unaccount_mem() functions call get_uid() which increments the reference count of struct user_struct on every invocation. But we don't decrement the count by calling free_uid(). It also accounted/unaccounted the pages against the current->mm. But its possible the unaccount_mem() can be called from a different process context than the one that originally pinned the pages. Let's fix this by storing the pinning process user_struct and mm_struct when accounting for pinned pages, and subsequently free these resources when the pages are unpinned. [borntraeger@linux.ibm.com: Fixed whitespace]

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

12%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.21% on 06-10-2026

06-10-202605-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: not stated in public data.

Ubuntu157 products
  • linuxAll versions (No fix recorded) | < 7.0.0-42.42
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 7.0.0-1016.17
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.187-1 | < 6.12.105-1 | < 7.1.8-1
  • linux-6.12< 6.12.107-1~deb12u1
Linux1 product
  • linux≥ 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc, < ad1c2ac7f15b224cf9ab26b593caa9bd1a4be72e | ≥ 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc, < dc7465a364104526c56b922c9de9dfcc08a7d5f7 | ≥ 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc, < 47cfd75d9df7c8f425b0d769328fe43a8a8e606e | ≥ 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc, < 70871b121f81d08879363cb1238a4c85c5c2800c | ≥ 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc, < e3f732e086e438c52c7400bd2734bb166aa4752c | ≥ 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc, < 36f6999ecde3976731a8bfc0b8e667da6f593069 | 6.0

3 vendors · 160 products

References

12 links
Show all 12 references