CVE-2026-74518

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description List corruption occurs in the allocate file region entries() function when topping up the resv->region cache with file region descriptors. The issue arises because list splice() is used to move entries without re-initializing the source head allocated regions. In shared mapping scenarios, concurrent calls to region chg(), region add(), or region del() on the same resv map can force a second iteration of the allocation loop. This second iteration calls list add() on the stale head, leading to list corruption. If CONFIG DEBUG LIST is disabled, a kernel-stack address is silently linked into the resv->region cache, which can result in a use-after-free condition. This issue has been observed causing host panics on dense KVM hosts where a hugetlbfs file was mapped as MAP SHARED by both QEMU and an SPDK/DPDK vhost-user target.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.