CVE-2026-74513

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister<br /> <br /> dibs_lo_attach_dmb(), dibs_lo_detach_dmb() and dibs_lo_unregister_dmb()<br /> look up the dmb_node under dmb_ht_lock, drop the lock and only then<br /> operate on the node&amp;#39;s refcount. Nothing keeps the node alive across<br /> that window: __dibs_lo_unregister_dmb() removes the node from the hash<br /> table under the write lock and immediately frees it.<br /> <br /> A concurrent final put can therefore free the node between the lookup<br /> and the refcount operation:<br /> <br /> CPU0 (attach) CPU1 (owner unregisters)<br /> <br /> read_lock_bh(&amp;dmb_ht_lock)<br /> find dmb_node (refcnt == 1)<br /> read_unlock_bh(&amp;dmb_ht_lock)<br /> refcount_dec_and_test() 1 -&gt; 0<br /> write_lock_bh(&amp;dmb_ht_lock)<br /> hash_del(&amp;dmb_node-&gt;list)<br /> write_unlock_bh(&amp;dmb_ht_lock)<br /> kfree(dmb_node)<br /> refcount_inc_not_zero(&amp;dmb_node-&gt;refcnt)