CVE-2026-74482

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-use-after-free issue exists in the Linux kernel within the folio split() function. The function continues to dereference the mapping after a split occurs, specifically during the execution of shmem uncharge(mapping->host) and remap page(). Because the i mmap unlock read(mapping) call occurs at the very end, after after-split folios have been unlocked and freed, there is a window where no inode reference is held. If a concurrent iput() call evicts and RCU-frees the inode before i mmap unlock read() accesses i mmap rwsem, a use-after-free occurs. This is particularly relevant when memory failure() splits a poisoned tail of a shmem THP (Transparent Huge Page) that extends beyond i size during truncation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.