{"id":"CVE-2026-74617","state":"PUBLISHED","title":"dibs: initialise dibs->lock in dibs_dev_alloc()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndibs: initialise dibs->lock in dibs_dev_alloc()\n\ndibs->lock is initialised by dibs_dev_add(), but a dibs device can\nalready take interrupts before that call: ism_probe() runs\nism_dev_init(), and hence request_irq(), before it calls\ndibs_dev_add(). No client can have registered a dmb at that point, so\nno dmb interrupt can occur, but a GID event interrupt can, and\nism_handle_irq() takes dibs->lock unconditionally on entry, before it\ninspects anything else.\n\nInitialise the lock in dibs_dev_alloc() instead, so that it is valid as\nsoon as a driver can publish the device to its interrupt handler.","publishedAt":"2026-08-22T15:32:02.049Z","updatedAt":"2026-10-16T19:06:02.395Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"cc21191b584c6f7836b0f10774f8278b7cbfba10","status":"affected","lessThan":"fe79571f40434b257d68cbfb7b3ae93a794d8a11","versionType":"git"},{"version":"cc21191b584c6f7836b0f10774f8278b7cbfba10","status":"affected","lessThan":"2926031acba100d0c18fcfaa7a2ed29609318848","versionType":"git"},{"version":"cc21191b584c6f7836b0f10774f8278b7cbfba10","status":"affected","lessThan":"c27e360545373b7aee9862a5beef3b9fb3df0c25","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/dibs/dibs_main.c","include/linux/dibs.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.18","versionType":"semver"},{"version":"6.18.45","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.9","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/dibs/dibs_main.c","include/linux/dibs.h"]}],"references":["https://git.kernel.org/stable/c/fe79571f40434b257d68cbfb7b3ae93a794d8a11","https://git.kernel.org/stable/c/2926031acba100d0c18fcfaa7a2ed29609318848","https://git.kernel.org/stable/c/c27e360545373b7aee9862a5beef3b9fb3df0c25"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/74xxx/CVE-2026-74617.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74617","state":"PUBLISHED","datePublished":"2026-08-22T15:32:02.049Z","dateUpdated":"2026-10-16T19:06:02.395Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-15T05:44:03.920Z"},"containers":{"cna":{"title":"dibs: initialise dibs->lock in dibs_dev_alloc()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndibs: initialise dibs->lock in dibs_dev_alloc()\n\ndibs->lock is initialised by dibs_dev_add(), but a dibs device can\nalready take interrupts before that call: ism_probe() runs\nism_dev_init(), and hence request_irq(), before it calls\ndibs_dev_add(). No client can have registered a dmb at that point, so\nno dmb interrupt can occur, but a GID event interrupt can, and\nism_handle_irq() takes dibs->lock unconditionally on entry, before it\ninspects anything else.\n\nInitialise the lock in dibs_dev_alloc() instead, so that it is valid as\nsoon as a driver can publish the device to its interrupt handler."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"cc21191b584c6f7836b0f10774f8278b7cbfba10","status":"affected","lessThan":"fe79571f40434b257d68cbfb7b3ae93a794d8a11","versionType":"git"},{"version":"cc21191b584c6f7836b0f10774f8278b7cbfba10","status":"affected","lessThan":"2926031acba100d0c18fcfaa7a2ed29609318848","versionType":"git"},{"version":"cc21191b584c6f7836b0f10774f8278b7cbfba10","status":"affected","lessThan":"c27e360545373b7aee9862a5beef3b9fb3df0c25","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/dibs/dibs_main.c","include/linux/dibs.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.18","versionType":"semver"},{"version":"6.18.45","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.9","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/dibs/dibs_main.c","include/linux/dibs.h"]}],"references":[{"url":"https://git.kernel.org/stable/c/fe79571f40434b257d68cbfb7b3ae93a794d8a11"},{"url":"https://git.kernel.org/stable/c/2926031acba100d0c18fcfaa7a2ed29609318848"},{"url":"https://git.kernel.org/stable/c/c27e360545373b7aee9862a5beef3b9fb3df0c25"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - On IBM Z SMC-D systems, a remote networked peer on the shared ISM fabric can emit GID/IEQ fabric events that raise ISM MSI interrupts during ism_probe, reaching ism_handle_irq() without any local syscall or ioctl on the victim.\nAC:L - The attacker controls timing by repeatedly sending ISM GID/IEQ fabric events (or coordinating with victim reboot/module reprobe) to hit the probe window between request_irq() and dibs_dev_add(), rather than depending on uncontrollable memory layout.\nPR:N - Exploitation is driven by ISM hardware interrupts from fabric events and does not require local credentials, capabilities, or namespaces on the victim; a remote/co-tenant ISM fabric peer can trigger the IRQ path during device bring-up.\nUI:N - The race occurs automatically during kernel boot or ISM driver probe when fabric GID events arrive; no victim user action such as mounting a filesystem or opening a device node is required.\nS:U - The flaw corrupts kernel driver state via an uninitialized spinlock in IRQ context but does not cross a VM, IOMMU, or sandbox security boundary; impact remains within kernel privilege.\nC:H - Calling spin_lock() on an uninitialized dibs->lock is undefined behavior that can corrupt lock metadata and adjacent dibs_dev fields, creating a memory-safety primitive that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Broken spinlock initialization can permit unsafe concurrent access to dibs_dev state and enable arbitrary kernel memory writes or control-flow hijacking, not merely a clean denial of service.\nA:H - Taking an uninitialized spinlock in ism_handle_irq() can trigger kernel BUG/oops/panic or wedge ISM interrupt handling, causing a high-severity system crash or hang on affected IBM Z hosts."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-25T05:40:44.661Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"6.18.45"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.1.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-74617","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T19:02:36.634997Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:06:02.395Z"}}]}}}