The CVSS 9.8 rating for CVE-2026-74401 is analytically misleading. This is not a trivially exploitable critical flaw but a concurrency edge case with narrow trigger conditions that required an experimental DLM branch and custom io_uring benchmarking infrastructure to surface. Sequence number ordering in DLM's send queue can violate the invariant that dlm_receive_ack depends on, producing refcounting errors and use-after-free—but triggering this in practice means saturating the DLM messaging layer in a way that disrupts sequence number assignment ordering. That's a fundamentally different proposition from sending malformed packets.
The EPSS of 0.0045 captures the actual risk more honestly than the CVSS score. What's analytically significant is that this ordering invariant was not enforced in the code's design—the bug emerged from interaction between network pressure and sequence number generation under load, not from a single bad operation. The testing infrastructure that missed this is the real concern: if concurrency bugs in the send queue require specialized io_uring load generation to trigger, the existing test suite is structurally blind to this entire class of vulnerability.
Audit your DLM deployment. First, verify you are running mainline DLM and not a modified experimental branch—the researcher explicitly states they could only reproduce this in an experimental context, which raises uncomfortable questions about whether mainline is silently immune or vulnerable through a different pathway. Second, examine DLM logs for unexplained refcount errors or messages about acknowledgment timeouts, which could indicate this bug or a similar latent ordering violation firing under production load. Third, treat the fix as a forcing function to audit the full DLM message lifecycle for implicit ordering assumptions that are structurally enforced in the code. The before(mh->seq, seq) check in dlm_receive_ack was written with assumptions nobody codified or tested—the question is how many similar implicit contracts exist elsewhere in DLM's message paths. The fix addresses the symptom; the disease is code maintained without re-examining concurrency invariants as the kernel evolved.