Linux Kernel CVE-2026-74481

Exploitation requires all of the following concurrent conditions: (1) The Linux guest kernel must have CONFIG_PAGE_REPORTING compiled in and the virtio_balloon driver loaded - this is common in KVM/QEMU guests but not present on bare-metal systems or non-virtio hypervisors. (2) A PM suspend (S3) or hibernation (S4) cycle must be initiated - exploitation cannot occur during normal operation. (3) Concurrent memory pressure must exist during the freeze window so the buddy allocator processes freed pages and triggers the reporting callback - setting page_reporting_order=0 maximizes sensitivity, but the bug can also trigger under natural memory churn during S4 image saving via the balloon shrinker. Exploitation is limited by: requirement of a virtualized guest environment (bare-metal systems without virtio_balloon are unaffected), the need to trigger a suspend/hibernate event, and the narrow timing race between virtqueue teardown and reporting worker execution. Authentication requirements are not explicitly confirmed from CVSS alone; PR:L indicates low-privilege local access is sufficient to trigger the suspend cycle, but this may require systemd/logind permissions on hardened systems.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects the theoretical maximum impact of a kernel UAF - memory corruption that could enable privilege escalation or kernel code execution. In practice, exploitation requires a convergence of specific conditions: a virtualized guest using virtio_balloon with page reporting active, a suspend or hibernation cycle, and concurrent memory pressure. This significantly narrows the realistic risk surface compared to the raw CVSS score. EPSS of 0.18% (8th percentile) confirms that exploitation is not being observed in the wild and is not expected to be straightforward. There is no CISA KEV listing and no public proof-of-concept. The most realistic impact is an unrecoverable kernel crash (GPF) during suspend/resume, affecting availability. The confidentiality and integrity impact components (C:H/I:H) are theoretically possible via kernel heap exploitation post-UAF but would require sophisticated, targeted effort. Google has confirmed the crash is reproducible under stress conditions, validating real-world impact for virtualized workloads performing power management.

A virtualized Linux guest (e.g., a KVM/QEMU VM with virtio_balloon enabled) initiates a suspend-to-RAM (S3) or hibernation (S4) cycle - either via operator command or automated power management. During the freeze phase, the virtio_balloon driver deletes its virtqueues, but the page_reporting_process worker continues executing on system_wq. Simultaneously, the balloon shrinker returns pages to the buddy allocator, triggering virtballoon_free_page_report() against the already-freed virtqueue structures, causing a General Protection Fault and kernel panic. No public exploit code has been identified at time of analysis; Google confirmed the crash is reproducible under stress-ng memory churn with page_reporting_order=0.