Linux Kernel CVE-2026-74690

Exploitation requires: (1) IBM Z (s390x) hardware with an ISM-capable adapter physically present and the ism kernel module loaded; (2) the ability to initiate ISM device removal (ism_dev_exit()), which typically requires CAP_SYS_ADMIN or equivalent kernel capability - not accessible to unprivileged local users; (3) a concurrent active ISM interrupt handler executing at the precise moment of device teardown (a transient race window). Limiting factors: the attack surface is entirely local to IBM Z mainframe environments; the race condition introduces timing dependency that makes reliable exploitation difficult; and the ISM subsystem is not compiled or loaded in generic x86/ARM kernel builds, eliminating the vast majority of Linux deployments from scope.

The provided CVSS 8.4 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk on two metrics. AC:L is not accurate for a race condition - successful exploitation requires precise timing between the device-exit path and an active interrupt handler, which raises practical complexity. PR:N also warrants scrutiny: triggering ism_dev_exit() is a kernel-level device-removal operation that typically requires elevated capabilities (CAP_SYS_ADMIN or equivalent), making PR:N a likely mis-scoring. Contrasting signals: EPSS at 0.21% (11th percentile) aligns with the assessment that exploitation is technically demanding and highly environment-specific; the vulnerability is not in CISA KEV; no public exploit code is known. The realistic threat actor is a privileged local user or a process with device-management capabilities on an IBM Z system with ISM hardware - a very narrow attack surface. SSVC signals lean toward 'defer': exploitation is not automatable (AV:L, race condition, IBM Z-only), and the technical impact, while high in theory, is limited to environments operating IBM Z infrastructure. The CVSS C:H/I:H/A:H impact metrics are plausible for a kernel UAF but require exploitation of a race window that is transient and hardware-specific.

A local attacker with sufficient privilege to trigger ISM device removal initiates ism_dev_exit() while a concurrent ISM interrupt handler is executing. If the race window is won - the handler reads sba or ieq after they are freed - the attacker can influence freed kernel memory to achieve arbitrary kernel read/write, potentially escalating to root. No public proof-of-concept exists at time of analysis.