Linux Kernel CVE-2026-74674

Exploitation requires a local unprivileged account (PR:L per CVSS) - no network-based exploitation path exists. The vulnerability is triggered during virtual memory unmapping operations (munmap or equivalent) when zap_pte_range encounters a page table eligible for reclaim, a code path reachable by any standard user process making normal memory management syscalls. Reliable exploitation is gated on CPU microarchitecture: AMD systems with EFER.TCE enabled are the primary risk group because INVLPG on AMD is restricted to flushing only the specified target address, making the wrong-address flush completely ineffective and leaving the stale cache entry intact. Intel systems where flush_tlb_one_user selects INVPCID (PCID-capable CPUs with appropriate kernel config) face the same condition. Intel systems using plain INVLPG without INVPCID are partially self-mitigated because INVLPG on non-TCE Intel flushes all paging-structure-caches regardless of address. KPTI (Kernel Page Table Isolation) configuration may further alter the exploitability surface. The kernel commit characterizes the precise control flow required to reach the bad code path as 'very complex,' indicating the race window is narrow and deterministic triggering is non-trivial even under ideal architecture conditions.

The NVD-assigned CVSS 7.8 High score with AV:L/AC:L/PR:L/UI:N captures the local exploitation requirement and full C/I/A impact potential, but AC:L likely overstates reliability - the kernel commit itself characterizes the triggering conditions as 'very complex' given the convoluted control flow of zap_pte_range, and reliable exploitation is further gated on specific CPU microarchitecture. The EPSS score of 0.20% (10th percentile) reinforces this, indicating negligible observed exploitation activity in the wild. The vulnerability is absent from CISA KEV and no proof-of-concept exploit is known. From an SSVC perspective, exploitation is non-automatable (requires local access, architecture-specific conditions, and timing), but technical impact is high if the race is won. Even a mid-sized municipal IT team in mielec running AMD-based Linux servers should treat kernel upgrades as urgent, given the EFER.TCE factor makes the stale-cache condition fully non-mitigating on that platform - unlike Intel without INVPCID, where the bug accidentally resolves itself. The CVSS C:H/I:H/A:H impact triad is justified: stale paging cache access can expose kernel memory, corrupt page mappings, and destabilize the system. A CVSS 4.0 assessment would likely score this somewhat lower than 7.8 given the attack requirements, but the impact potential is real for unpatched AMD and modern Intel deployments.

A local attacker with a standard unprivileged account on an AMD Linux server allocates a large virtual memory region and calls munmap, causing zap_pte_range to reclaim page tables while issuing a TLB flush to an incorrect virtual address. The CPU retains a stale paging-structure-cache entry referencing the now-freed page table; speculative memory accesses through this stale entry allow the attacker to read kernel memory or - if the freed physical page is reallocated for a security-sensitive kernel structure - to corrupt kernel data and escalate privileges. No public proof-of-concept exploit exists at time of analysis, though the upstream commit references an apparent real-world symptom in the ripgrep crash report at https://github.com/BurntSushi/ripgrep/issues/3494.