{"cve":"CVE-2026-74514","nvd":{"published":"2026-08-15T13:17:56.530","modified":"2026-08-23T13:16:45.457","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: Fix memory accounting for pinned/unpinned pages\n\nThe account_mem() and unaccount_mem() functions call get_uid() which\nincrements the reference count of struct user_struct on every invocation.\nBut we don't decrement the count by calling free_uid(). It also\naccounted/unaccounted the pages against the current->mm. But its possible\nthe unaccount_mem() can be called from a different process context than the\none that originally pinned the pages.\n\nLet's fix this by storing the pinning process user_struct and mm_struct\nwhen accounting for pinned pages, and subsequently free these resources\nwhen the pages are unpinned.\n\n[borntraeger@linux.ibm.com: Fixed whitespace]","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/36f6999ecde3976731a8bfc0b8e667da6f593069","https://git.kernel.org/stable/c/47cfd75d9df7c8f425b0d769328fe43a8a8e606e","https://git.kernel.org/stable/c/70871b121f81d08879363cb1238a4c85c5c2800c","https://git.kernel.org/stable/c/ad1c2ac7f15b224cf9ab26b593caa9bd1a4be72e","https://git.kernel.org/stable/c/dc7465a364104526c56b922c9de9dfcc08a7d5f7"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:49:10.689564601+00:00"},"epss":{"cve":"CVE-2026-74514","score":0.00215,"percentile":0.11848,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}