CVE-2026-74365
CVE CVE-2026-74365EUVD EUVD-2026-59512Published 2026-08-15T05:58:47.000ZLast changed 2026-08-17T05:46:24.000ZCVSS 7.3
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane acquisition that can lead to silent data corruption. The existing lane model uses a spinlock together with a per-CPU recursion count. That recursion model stopped being valid after BTT lanes became preemptible: another task can run on the same CPU, observe a non-zero recursion count, bypass locking, and use the same lane concurrently. BTT lanes are also held across arena_write_bytes() calls. That path reaches nsio_rw_bytes(), which flushes writes with nvdimm_flush(). Some provider flush callbacks can sleep, making a spinlock the wrong primitive for the lane lifetime. Replace the spinlock-based recursion model with a dynamically allocated per-lane mutex array and take the lane lock unconditionally. Add might_sleep() to catch any future atomic-context caller. Found with the ndctl unit test btt-check.sh.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux 36c75ce3bd299878fd9b238e9803d3817ddafbf3 <8d4b989d9c9afe5f185aa5853b666fc4617afe9e; 6.1.63 <6.1.178; 6f50b414f1a0d790f11a6438a3ad6d0577eb2c18 <73e35c1bdfa160b41fdbe204e02325f0687de506; 5.15.139 <5.16; f23859748e3d530217b197e146a9ac84faf0a282 <fd7a97b2514cfc4b4cc067a27dd39bde2a8b1735; patch: 7.1.5; patch: 6.18.40; b27751fb1f271bbb78d5993c0b10011628e40e18; patch: 0; patch: 7.2; patch: 6.6.145; 36c75ce3bd299878fd9b238e9803d3817ddafbf3 <4eafa810b042d985ec6bbf5b514414e73cee6f6f; 4.19.299 <4.20; patch: 6.1.178; patch: 6.12.97; 6.5.12 <6.6; 6.6.2 <6.6.145; 5.4.261 <5.5; 6.7; 40ba3fa21250e361bdd8f00800b3e2cb6160de95; 66eb7b7f23dd9aec5356e7054dd3596ae7648ff5; 36c75ce3bd299878fd9b238e9803d3817ddafbf3 <5c53406098b599c420b031e6ec5ba8a2f3794c50; 36c75ce3bd299878fd9b238e9803d3817ddafbf3 <417918783bcfe0be135019df16a267b3af442efd; 2577fece583c7c05cda7ad50dde7638c962665e1; b0e7a935739f33ed2bd6868b89f97dd4c2683c26; 5.10.201 <5.11
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.