Linux Kernel CVE-2026-74513

Exploitation requires a local shell with at least low-privilege access (PR:L per CVSS) on a Linux kernel version containing the vulnerable dibs loopback code. The race can only be triggered on systems where the SMC-D protocol with dibs loopback or ISM is active and accessible to the attacker's process - this is a non-default configuration found primarily in IBM Z and SMC-D-enabled enterprise Linux deployments. Concurrent execution (multi-core or preemptible kernel) is necessary to open the race window. Exploitation is limited by: the non-default nature of SMC-D loopback (most general-purpose Linux systems do not load or use this code path), the need to race kernel-level lock/unlock operations (requires timing precision), and the requirement for pre-existing local access. Remote exploitation is not possible per AV:L.

The official CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) correctly identifies local authenticated exploitation with unchanged scope and high system impact. However, AC:L may overstate exploitability: winning this race requires precisely timed concurrent kernel operations, which adds practical complexity beyond what AC:L implies. EPSS at 0.17% (6th percentile) corroborates that no widespread exploit tooling is circulating. The vulnerability is not listed in CISA KEV and no POC has been identified. Real-world risk is further bounded by the requirement that SMC-D loopback via the dibs/ISM path must be active - a configuration found primarily in IBM Z mainframe-adjacent Linux environments, not general-purpose distributions. For enterprises not running SMC-D workloads, exposure is negligible despite the high CVSS base score. For IBM Z or SMC-D-enabled deployments, this is a credible local privilege escalation path that warrants prompt patching.

A local attacker with a low-privilege shell on a Linux system running SMC-D loopback opens two threads: one repeatedly calls the dibs attach path on a target DMB node while the other triggers the unregister path on the same node. When the unregister thread wins the race and frees the dmb_node between the attach thread's hash lookup and its refcount_inc_not_zero call, the attach thread operates on freed kernel memory. The attacker then reclaims the freed slab object with a controlled allocation, achieving a type-confusion or heap spray primitive usable for privilege escalation to root. No public exploit code exists at time of analysis.