CVE-2026-74379

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dax/kmem: account for partial discontiguous resource upon removal

When dev_dax_kmem_probe() partially succeeds (at least one range is

mapped) but a subsequent range fails request_mem_region() or

add_memory_driver_managed(), the probe silently continues, ultimately

returning success, but with the corresponding range resource NULL'ed out.

dev_dax_kmem_remove() iterates over all dax_device ranges regardless of if

the underlying resource exists. When remove_memory() is called later, it

returns 0 because the memory was never added which causes

dev_dax_kmem_remove() to incorrectly assume the (nonexistent) resource can

be removed and attempts cleanup on a NULL pointer.

Fix this by skipping these ranges altogether, noting that these cases are

considered success, such that the cleanup is still reached when all

actually-added ranges are successfully removed.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References