{"id":"CVE-2026-74401","title":"dlm: fix add msg handle in send_queue ordered","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix add msg handle in send_queue ordered\n\nIn a benchmark scenario triggering a lot of requests that triggers a lot\nof DLM messages on the network it can be that th…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 489d8e559c6596eb08e16447d9830bc39afbe54e < ae9e534e502a0f48c12baf83608c5de0ff0eab11","Linux >= 489d8e559c6596eb08e16447d9830bc39afbe54e < 6369619f1b665f12d8c99cc6ff733c64eb08b22e","Linux >= 489d8e559c6596eb08e16447d9830bc39afbe54e < 712714f818d83373847874ab0f8e426be79296cf","Linux >= 489d8e559c6596eb08e16447d9830bc39afbe54e < 4d45250b1d22960f86d83245be188b16e456218b","Linux >= 489d8e559c6596eb08e16447d9830bc39afbe54e < d2248cb70c070f8f04762872772e155b59016f17","Linux 5.14"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T18:55:33.158512Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:05:42.033Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74401","references":[{"url":"https://git.kernel.org/stable/c/ae9e534e502a0f48c12baf83608c5de0ff0eab11"},{"url":"https://git.kernel.org/stable/c/6369619f1b665f12d8c99cc6ff733c64eb08b22e"},{"url":"https://git.kernel.org/stable/c/712714f818d83373847874ab0f8e426be79296cf"},{"url":"https://git.kernel.org/stable/c/4d45250b1d22960f86d83245be188b16e456218b"},{"url":"https://git.kernel.org/stable/c/d2248cb70c070f8f04762872772e155b59016f17"}],"tags":["cve.org"],"epss":0.00652,"epssPercentile":0.50217,"ingestedAt":"2026-10-16T19:46:24.368Z","slug":"CVE-2026-74401","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix add msg handle in send_queue ordered\n\nIn a benchmark scenario triggering a lot of requests that triggers a lot\nof DLM messages on the network it can be that the mh->seq is not ordered\naccording the oldest seq number. This ordering is required by\ndlm_receive_ack as \"before(mh->seq, seq)\" will stop to check for older\nsequence numbers that are ordered in the tail of \"node->send_queue\".\n\nThe side effects of not having it correct ordered regarding\n\"before(mh->seq, seq)\" are refcounting issues and use-after free.\n\nI only was able to reproduce this issue in a experimental DLM branch\nand a user space DLM benchmark that uses io_uring. After changing this I\ndon't experienced any refcounting with the sending buffer issues anymore.\n\n## Affected\n\n- `Linux >= 489d8e559c6596eb08e16447d9830bc39afbe54e < ae9e534e502a0f48c12baf83608c5de0ff0eab11`\n- `Linux >= 489d8e559c6596eb08e16447d9830bc39afbe54e < 6369619f1b665f12d8c99cc6ff733c64eb08b22e`\n- `Linux >= 489d8e559c6596eb08e16447d9830bc39afbe54e < 712714f818d83373847874ab0f8e426be79296cf`\n- `Linux >= 489d8e559c6596eb08e16447d9830bc39afbe54e < 4d45250b1d22960f86d83245be188b16e456218b`\n- `Linux >= 489d8e559c6596eb08e16447d9830bc39afbe54e < d2248cb70c070f8f04762872772e155b59016f17`\n- `Linux 5.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}