CVE-2026-74617
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel, the dibs module initializes the dibs->lock too late, only in dibs_dev_add(), while interrupts can occur earlier. This can lead to use of an uninitialized lock in interrupt handling.
Risk Assessment
Potential system crashes or unpredictable behavior if GID interrupts occur before lock initialization. This can affect system stability.
Recommendation
Apply a Linux kernel update that includes the fix initializing the lock in dibs_dev_alloc().
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs->lock in dibs_dev_alloc() dibs->lock is initialised by dibs_dev_add(), but a dibs device can already take interrupts before that call: ism_probe() runs ism_dev_init(), and hence request_irq(), before it calls dibs_dev_add(). No client can have registered a dmb at that point, so no dmb interrupt can occur, but a GID event interrupt can, and ism_handle_irq() takes dibs->lock unconditionally on entry, before it inspects anything else. Initialise the lock in dibs_dev_alloc() instead, so that it is valid as soon as a driver can publish the device to its interrupt handler.