CVE-2026-74514
Description
AI Translation Available
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
The account_mem() and unaccount_mem() functions call get_uid() which
increments the reference count of struct user_struct on every invocation.
But we don't decrement the count by calling free_uid(). It also
accounted/unaccounted the pages against the current->mm. But its possible
the unaccount_mem() can be called from a different process context than the
one that originally pinned the pages.
Let's fix this by storing the pinning process user_struct and mm_struct
when accounting for pinned pages, and subsequently free these resources
when the pages are unpinned.
[[email protected]: Fixed whitespace]
https://git.kernel.org/stable/c/36f6999ecde3976731a8bfc0b8e667da6f593069
https://git.kernel.org/stable/c/70871b121f81d08879363cb1238a4c85c5c2800c
https://git.kernel.org/stable/c/e3f732e086e438c52c7400bd2734bb166aa4752c