CVE-2026-74379
In the Linux kernel, the following vulnerability has been resolved: dax/kmem: account for partial discontiguous resource upon removal When dev_dax_kmem_probe() partially succeeds (at least one range is mapped) but a subsequent range fails request_mem_region() or add_memory_driver_managed(), the probe silently continues, ultimately returning success, but with the corresponding range resource NULL'ed out. dev_dax_kmem_remove() iterates over all dax_device ranges regardless of if the underlying resource exists. When remove_memory() is called later, it returns 0 because the memory was never added which causes dev_dax_kmem_remove() to incorrectly assume the (nonexistent) resource can be removed and attempts cleanup on a NULL pointer. Fix this by skipping these ranges altogether, noting that these cases are considered success, such that the cleanup is still reached when all actually-added ranges are successfully removed.
Affected versions
Linux kernel versions
5.10
and later are affected. Fixed in
5.15.212,
6.1.178,
6.6.145,
6.12.97,
6.18.40,
7.1.5,
7.2-rc1
and their respective stable series.
References
7 totalFrequently asked questions
-
What is CVE-2026-74379?
CVE-2026-74379 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.10 onward and has been patched in 5.15.212, 6.1.178, 6.6.145 and others. CVE-2026-74379 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-74379?
Yes. CVE-2026-74379 has been patched. Fixed versions include 5.15.212, 6.1.178, 6.6.145 and others. If you are running Linux kernel 5.10 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-74379 actively exploited?
No. CVE-2026-74379 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.