CVE-2026-74482

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios

__folio_split() keeps dereferencing the mapping after the split:

shmem_uncharge(mapping->host) and remap_page() while the folios are still

frozen/locked, and i_mmap_unlock_read(mapping) at the very end, after the

after-split folios have been unlocked and freed.

Nothing holds an inode reference across that. The split relies on @folio

-- which the beyond-EOF drop loop never removes, as it starts at

folio_next(folio) -- staying locked and in the page cache to hold off

eviction. But the unlock loop unlocks @folio before i_mmap_unlock_read()

runs. If the caller's @lock_at is a tail beyond EOF, as memory_failure()

passes when splitting a poisoned tail of a shmem THP that reaches past

i_size during truncation, it too is gone from the page cache; so once

@folio is unlocked no locked, in-cache folio pins the inode, and a

concurrent final iput() can ev

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References