CVE-2026-74481

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/page_reporting: use system_freezable_wq to fix UAF during suspend

During PM freeze (e.g. S3 suspend or S4 hibernation), device drivers like

virtio_balloon reset their underlying virtio devices and delete their

virtqueues via vdev->config->del_vqs().

However, page reporting work (page_reporting_process) was scheduled on the

global system_wq. Because system_wq lacks the WQ_FREEZABLE flag, the PM

freezer skips it, leaving page_reporting_process active during suspend.

If pages are freed into the buddy allocator while suspending (for example,

when core MM invokes the balloon shrinker during S4 hibernation image

saving), page reporting triggers virtballoon_free_page_report() on deleted

virtqueues, resulting in a Use-After-Free / General Protection Fault:

[ 196.795226] general protection fault, probably for non-canonical address 0xaa1436fe70dae6df: 0000 [#1] SMP NOPTI

[ 196.825967] Workqueue: events page_r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References