CVE-2026-74719 (GCVE-0-2026-74719)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-22 15:33
VLAI
EPSS
VEX
Title
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
The SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in
smc_llc_event_handler() stores an incoming qentry into the local LLC flow
without first checking whether a qentry is already pending. If a malicious or
buggy peer sends a second CONFIRM_LINK or ADD_LINK_CONT request while a flow is
active and flow->qentry is already set, smc_llc_flow_qentry_set() overwrites the
pointer without freeing the previous allocation, leaking one kmalloc-96 object
per spurious message.
The sibling SMC_LLC_DELETE_LINK branch already has the correct !flow->qentry
guard. Apply the same guard to the CONFIRM_LINK/ADD_LINK_CONT branch so that a
duplicate message when qentry is already occupied falls through to break and is
freed by the kfree(qentry) at the out: label, rather than silently leaking the
existing allocation.
The response direction (smc_llc_rx_response()) is unaffected: it already guards
with flow->qentry at the equivalent site and drops duplicate responses
correctly.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 , < e384f3cba6ea709f5b2272b1770db4ce14047f78
(git)
Affected: 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 , < a1e980d7a9e7ee6faf4f5fd7b450413b969af26d (git) Affected: 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 , < e0eb87677c76b157cdf8eb7c1f19e56227165a33 (git) Affected: 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 , < 06734dfeaeba886aab1bf147249195b888ac3e4d (git) Affected: 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 , < c23c409228629107203d3c3e95fff1473173f1a6 (git) Affected: 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 , < 10cb31b2b74cb664c6c95cf72364d7d5c483ab82 (git) Affected: 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 , < bfc336a9fbbf09805f3dfe25c195a4db90af2846 (git) Affected: 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 , < 976245094925bab9bc39366b2e9ab44ffcde61d0 (git) |
guessed | |
| Linux | Linux |
Affected:
5.8
Unaffected: 0 , < 5.8 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/smc/smc_llc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e384f3cba6ea709f5b2272b1770db4ce14047f78",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "a1e980d7a9e7ee6faf4f5fd7b450413b969af26d",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "e0eb87677c76b157cdf8eb7c1f19e56227165a33",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "06734dfeaeba886aab1bf147249195b888ac3e4d",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "c23c409228629107203d3c3e95fff1473173f1a6",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "10cb31b2b74cb664c6c95cf72364d7d5c483ab82",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "bfc336a9fbbf09805f3dfe25c195a4db90af2846",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "976245094925bab9bc39366b2e9ab44ffcde61d0",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/smc/smc_llc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n\nThe SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in\nsmc_llc_event_handler() stores an incoming qentry into the local LLC flow\nwithout first checking whether a qentry is already pending. If a malicious or\nbuggy peer sends a second CONFIRM_LINK or ADD_LINK_CONT request while a flow is\nactive and flow-\u003eqentry is already set, smc_llc_flow_qentry_set() overwrites the\npointer without freeing the previous allocation, leaking one kmalloc-96 object\nper spurious message.\n\nThe sibling SMC_LLC_DELETE_LINK branch already has the correct !flow-\u003eqentry\nguard. Apply the same guard to the CONFIRM_LINK/ADD_LINK_CONT branch so that a\nduplicate message when qentry is already occupied falls through to break and is\nfreed by the kfree(qentry) at the out: label, rather than silently leaking the\nexisting allocation.\n\nThe response direction (smc_llc_rx_response()) is unaffected: it already guards\nwith flow-\u003eqentry at the equivalent site and drops duplicate responses\ncorrectly."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:33:12.716Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e384f3cba6ea709f5b2272b1770db4ce14047f78"
},
{
"url": "https://git.kernel.org/stable/c/a1e980d7a9e7ee6faf4f5fd7b450413b969af26d"
},
{
"url": "https://git.kernel.org/stable/c/e0eb87677c76b157cdf8eb7c1f19e56227165a33"
},
{
"url": "https://git.kernel.org/stable/c/06734dfeaeba886aab1bf147249195b888ac3e4d"
},
{
"url": "https://git.kernel.org/stable/c/c23c409228629107203d3c3e95fff1473173f1a6"
},
{
"url": "https://git.kernel.org/stable/c/10cb31b2b74cb664c6c95cf72364d7d5c483ab82"
},
{
"url": "https://git.kernel.org/stable/c/bfc336a9fbbf09805f3dfe25c195a4db90af2846"
},
{
"url": "https://git.kernel.org/stable/c/976245094925bab9bc39366b2e9ab44ffcde61d0"
}
],
"title": "net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74719",
"datePublished": "2026-08-22T15:33:12.716Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-08-22T15:33:12.716Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74719",
"date": "2026-10-16",
"epss": "0.00177",
"percentile": "0.0675"
},
"microsoft_vex": {
"current_release_date": "2026-09-25T02:03:21.000Z",
"cve": "CVE-2026-74719",
"id": "msrc_CVE-2026-74719",
"initial_release_date": "2026-08-24T01:06:24.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74719.json",
"version": "5"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/smc/smc_llc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e384f3cba6ea709f5b2272b1770db4ce14047f78",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "a1e980d7a9e7ee6faf4f5fd7b450413b969af26d",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "e0eb87677c76b157cdf8eb7c1f19e56227165a33",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "06734dfeaeba886aab1bf147249195b888ac3e4d",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "c23c409228629107203d3c3e95fff1473173f1a6",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "10cb31b2b74cb664c6c95cf72364d7d5c483ab82",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "bfc336a9fbbf09805f3dfe25c195a4db90af2846",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "976245094925bab9bc39366b2e9ab44ffcde61d0",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/smc/smc_llc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n\nThe SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in\nsmc_llc_event_handler() stores an incoming qentry into the local LLC flow\nwithout first checking whether a qentry is already pending. If a malicious or\nbuggy peer sends a second CONFIRM_LINK or ADD_LINK_CONT request while a flow is\nactive and flow-\u003eqentry is already set, smc_llc_flow_qentry_set() overwrites the\npointer without freeing the previous allocation, leaking one kmalloc-96 object\nper spurious message.\n\nThe sibling SMC_LLC_DELETE_LINK branch already has the correct !flow-\u003eqentry\nguard. Apply the same guard to the CONFIRM_LINK/ADD_LINK_CONT branch so that a\nduplicate message when qentry is already occupied falls through to break and is\nfreed by the kfree(qentry) at the out: label, rather than silently leaking the\nexisting allocation.\n\nThe response direction (smc_llc_rx_response()) is unaffected: it already guards\nwith flow-\u003eqentry at the equivalent site and drops duplicate responses\ncorrectly."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/smc: correcci\u00f3n de sobrescritura de qentry para CONFIRM_LINK y ADD_LINK_CONT en smc_llc_event_handler()\n\nLa rama SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT en smc_llc_event_handler() almacena un qentry entrante en el flujo LLC local sin verificar primero si un qentry ya est\u00e1 pendiente. Si un par malicioso o defectuoso env\u00eda una segunda solicitud CONFIRM_LINK o ADD_LINK_CONT mientras un flujo est\u00e1 activo y flow -\u003e qentry ya est\u00e1 establecido, smc_llc_flow_qentry_set() sobrescribe el puntero sin liberar la asignaci\u00f3n anterior, fugando un objeto kmalloc-96 por mensaje espurio.\n\nLa rama hermana SMC_LLC_DELETE_LINK ya tiene la protecci\u00f3n !flow -\u003e qentry correcta. Aplique la misma protecci\u00f3n a la rama CONFIRM_LINK/ADD_LINK_CONT para que un mensaje duplicado, cuando qentry ya est\u00e1 ocupado, pase a \u0027break\u0027 y sea liberado por kfree(qentry) en la etiqueta \u0027out:\u0027, en lugar de fugar silenciosamente la asignaci\u00f3n existente.\n\nLa direcci\u00f3n de respuesta (smc_llc_rx_response()) no se ve afectada: ya se protege con flow -\u003e qentry en el sitio equivalente y descarta las respuestas duplicadas correctamente."
}
],
"id": "CVE-2026-74719",
"lastModified": "2026-10-14T13:10:00.187",
"metrics": {},
"published": "2026-08-22T16:16:46.830",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/06734dfeaeba886aab1bf147249195b888ac3e4d"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/10cb31b2b74cb664c6c95cf72364d7d5c483ab82"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/976245094925bab9bc39366b2e9ab44ffcde61d0"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a1e980d7a9e7ee6faf4f5fd7b450413b969af26d"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/bfc336a9fbbf09805f3dfe25c195a4db90af2846"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/c23c409228629107203d3c3e95fff1473173f1a6"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/e0eb87677c76b157cdf8eb7c1f19e56227165a33"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/e384f3cba6ea709f5b2272b1770db4ce14047f78"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-24T11:54:46+00:00",
"cve": "CVE-2026-74719",
"id": "CVE-2026-74719",
"initial_release_date": "2026-08-22T00:00:00+00:00",
"product_status:known_affected": "232",
"product_status:known_not_affected": "42",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74719.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.