CVE-2026-74481

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) and General Protection Fault can occur during Power Management (PM) freeze, such as S3 suspend or S4 hibernation. The issue arises because the page reporting process is scheduled on the global system wq, which lacks the WQ FREEZABLE flag. Consequently, the PM freezer does not pause this process during suspend. If pages are freed into the buddy allocator while suspending, the system may trigger the virtballoon free page report() function on virtqueues that have already been deleted via vdev->config->del vqs(), leading to a crash. The vulnerability involves the page reporting process function and the virtballoon free page report() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.