What’s Vulnerable › Vulnerabilities

CVE-2026-74327: vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-15 · updated 2026-08-17

Description

In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() find_vm_area() can return NULL if the given address is not a valid vmalloc area. Check the return value before dereferencing it to avoid a kernel crash.

Affected products

• Linux kernel: 5.13 — fixed in 7.2

How to fix

Upgrade to a fixed version: Linux kernel 7.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/55a44f5259e6a5f1d5b11cb0e19e943c9cc62280
• https://git.kernel.org/stable/c/a1bca6b69bd934e2731d009e645038e05d57ce59
• https://git.kernel.org/stable/c/af71c2b88ccae44418e273bdfe0c96be8515151e
• https://git.kernel.org/stable/c/b86f98e53df4f5d57259817b8e9a00167b78bae6
• https://git.kernel.org/stable/c/bbd664b7c77f6488cd5652231c0fe01d069a73ea
• https://git.kernel.org/stable/c/c55dd3b46c1208d6d2ea737a8aefef4aa4c70cb8
• https://git.kernel.org/stable/c/c741485fa09bf5900f76d95424d86316d0a00331

Get alerted when CVE-2026-74327 or the next vulnerability affects your stack