Linux Kernel CVE-2026-74401

Exploitation requires the target to be running the kernel DLM subsystem in an active cluster (clustered filesystem such as GFS2 or OCFS2 with corosync/pacemaker) - DLM is not compiled into or active on default single-node systems, which is the primary limiting factor. The attacker must be able to send DLM protocol messages from a cluster peer, i.e., effectively participate in or reach the trusted cluster interconnect, and must generate a very high request rate to trigger the out-of-order send_queue insertion race. The bug is timing/load-dependent (a benchmark-scale burst of DLM messages was needed to reproduce it), so single low-rate requests will not reliably trigger it; the provided AC:L/PR:N metrics understate these race-condition and cluster-membership prerequisites.

The signals conflict sharply and should be reconciled before prioritizing. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8) implies trivial remote unauthenticated memory corruption, but the description contradicts AC:L and PR:N: the bug is a timing-dependent race that the author could only reproduce on an experimental kernel branch under a heavy io_uring benchmark, and DLM messages originate from authenticated cluster peers on a trusted interconnect rather than arbitrary internet hosts. EPSS of 0.17% (6th percentile), absence from CISA KEV, and no known POC all corroborate low real-world exploitation likelihood. This is best treated as a reliability/stability fix and a hardening-priority use-after-free rather than an actively dangerous RCE - patch it in the normal kernel maintenance cycle for clustered systems, but the 9.8 rating overstates practical risk given the race condition and cluster-membership prerequisites. Verify the true attack surface with your cluster topology before treating it as internet-exposed.

An attacker with the ability to inject or generate high-volume DLM traffic on a cluster (e.g., a compromised or rogue cluster node) drives a benchmark-like burst of lock requests that causes message handles to be queued out of sequence order. The broken ordered scan in dlm_receive_ack then decrements refcounts incorrectly and frees a send buffer still in use, yielding a use-after-free that can crash the node or potentially be shaped toward kernel memory corruption. No public POC exists; the original author reproduced it only with an experimental DLM branch and an io_uring-based userspace benchmark.