SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-74617

CRITICAL · CVSS 9.8 EPSS 0.44%

Source: NVD + CISA KEV + EPSS · Published 2026-08-22 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel, specifically in the initialization of the dibs->lock variable within the dibs device allocation process. This flaw allows for potential race conditions, as interrupts can occur before the lock is properly initialized, leading to possible deadlocks or inconsistent states when handling interrupts. Organizations utilizing Linux systems, particularly those deploying drivers that interact with dibs devices, should prioritize addressing this issue to maintain system stability and security.

CVE
CVE-2026-74617
Severity
CRITICAL
CVSS
9.8
EPSS
0.44%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs->lock in dibs_dev_alloc() dibs->lock is initialised by dibs_dev_add(), but a dibs device can already take interrupts before that call: ism_probe() runs ism_dev_init(), and hence request_irq(), before it calls dibs_dev_add(). No client can have registered a dmb at that point, so no dmb interrupt can occur, but a GID event interrupt can, and ism_handle_irq() takes dibs->lock unconditionally on entry, before it inspects anything else. Initialise the lock in dibs_dev_alloc() instead, so that it is valid as soon as a driver can publish the device to its interrupt handler.