CVE-2026-74514

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The account_mem() and unaccount_mem() functions call get_uid() which increments the reference count of struct user_struct on every invocation. But we don't decrement the count by calling free_uid(). It also accounted/unaccounted the pages against the current->mm. But its possible the unaccount_mem() can be called from a different process context than the one that originally pinned the pages. Let's fix this by storing the pinning process user_struct and mm_struct when accounting for pinned pages, and subsequently free these resources when the pages are unpinned. [borntraeger@linux.ibm.com: Fixed whitespace]

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/36f6999ecde3976731a8bfc0b8e667da6f593069
https://git.kernel.org/stable/c/47cfd75d9df7c8f425b0d769328fe43a8a8e606e
https://git.kernel.org/stable/c/70871b121f81d08879363cb1238a4c85c5c2800c
https://git.kernel.org/stable/c/ad1c2ac7f15b224cf9ab26b593caa9bd1a4be72e
https://git.kernel.org/stable/c/dc7465a364104526c56b922c9de9dfcc08a7d5f7
https://git.kernel.org/stable/c/e3f732e086e438c52c7400bd2734bb166aa4752c

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-15 13:17

Updated : 2026-08-23 13:16

NVD link : CVE-2026-74514

Mitre link : CVE-2026-74514

CVE.ORG link : CVE-2026-74514

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-74514", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "ad1c2ac7f15b224cf9ab26b593caa9bd1a4be72e", "versionType": "git"}, {"status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "dc7465a364104526c56b922c9de9dfcc08a7d5f7", "versionType": "git"}, {"status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "47cfd75d9df7c8f425b0d769328fe43a8a8e606e", "versionType": "git"}, {"status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "70871b121f81d08879363cb1238a4c85c5c2800c", "versionType": "git"}, {"status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "e3f732e086e438c52c7400bd2734bb166aa4752c", "versionType": "git"}, {"status": "affected", "version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc", "lessThan": "36f6999ecde3976731a8bfc0b8e667da6f593069", "versionType": "git"}], "programFiles": ["arch/s390/kvm/pci.c", "arch/s390/kvm/pci.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"status": "unaffected", "version": "0", "lessThan": "6.0", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.184", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.44", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.8", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/s390/kvm/pci.c", "arch/s390/kvm/pci.h"], "defaultStatus": "affected"}]}], "published": "2026-08-15T13:17:56.530", "references": [{"url": "https://git.kernel.org/stable/c/36f6999ecde3976731a8bfc0b8e667da6f593069", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/47cfd75d9df7c8f425b0d769328fe43a8a8e606e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/70871b121f81d08879363cb1238a4c85c5c2800c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ad1c2ac7f15b224cf9ab26b593caa9bd1a4be72e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/dc7465a364104526c56b922c9de9dfcc08a7d5f7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e3f732e086e438c52c7400bd2734bb166aa4752c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: Fix memory accounting for pinned/unpinned pages\n\nThe account_mem() and unaccount_mem() functions call get_uid() which\nincrements the reference count of struct user_struct on every invocation.\nBut we don't decrement the count by calling free_uid(). It also\naccounted/unaccounted the pages against the current->mm. But its possible\nthe unaccount_mem() can be called from a different process context than the\none that originally pinned the pages.\n\nLet's fix this by storing the pinning process user_struct and mm_struct\nwhen accounting for pinned pages, and subsequently free these resources\nwhen the pages are unpinned.\n\n[borntraeger@linux.ibm.com: Fixed whitespace]"}], "lastModified": "2026-08-23T13:16:45.457", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}