{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_bpf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "90a19b0894ba79a699b48cf44421b36fbd566e99",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "d192cff2a37d59206dabe6ec2e60ceac6271f274",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "1cec526cf0a2227395f2c2f4b671cb052ff0b00e",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "a76624733730e541e4955fdecf506af2f6b20558",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_bpf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix sk_redir use-after-free in send verdict\n\nsk_psock_msg_verdict() takes a socket reference for psock-\u003esk_redir.\ntcp_bpf_send_verdict() copies that pointer while holding the source socket\nlock, but does not take a reference for the local copy before dropping the\nlock around tcp_bpf_sendmsg_redir().\n\nWhen apply_bytes keeps the cached verdict active, another sendmsg() on the\nsame source socket can consume the remaining bytes and release the cached\nreference while the first thread still holds only the raw local pointer:\n\n  CPU 0                                  CPU 1\n  sk_redir = psock-\u003esk_redir\n  apply_bytes remains nonzero\n  release_sock(sk)\n                                         lock_sock(sk)\n                                         apply_bytes reaches zero\n                                         psock-\u003esk_redir = NULL\n                                         release_sock(sk)\n                                         tcp_bpf_sendmsg_redir(sk_redir)\n                                         sock_put(sk_redir)\n  tcp_bpf_sendmsg_redir(sk_redir)\n\nThe final sock_put() can free sk_redir before CPU 0 dereferences it.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in tcp_bpf_sendmsg_redir+0xf39/0x1020\n  Read of size 8 at addr ffff888108537090 by task poc/87\n  Call Trace:\n   tcp_bpf_sendmsg_redir+0xf39/0x1020\n   tcp_bpf_sendmsg+0x977/0x1a50\n   __sys_sendto+0x32c/0x3a0\n   __x64_sys_sendto+0xdb/0x1b0\n  Allocated by task 85:\n   sk_prot_alloc+0x56/0x210\n   sk_clone+0x6f/0x14b0\n   inet_csk_clone_lock+0x24/0x740\n   tcp_create_openreq_child+0x25/0x2710\n   tcp_v4_syn_recv_sock+0x10a/0xe00\n  Freed by task 0:\n   __kasan_slab_free+0x43/0x70\n   slab_free_after_rcu_debug+0xa6/0x1e0\n   rcu_core+0x50a/0x1850\n  Last potentially related work creation:\n   __sk_destruct+0x3da/0x540\n   sk_psock_destroy+0x81e/0xab0\n   process_one_work+0x63a/0x1070\n\nTake a temporary socket reference while the source socket lock still\nprotects psock-\u003esk_redir, and drop it after tcp_bpf_sendmsg_redir()\nreturns.  This keeps each unlocked use independent of cached-verdict\nownership."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached via local sendmsg/sendto on a TCP socket whose -\u003esendmsg was replaced by tcp_bpf_sendmsg() after BPF sockmap SK_MSG verdict attachment; per kernel CNA BPF/sockmap guidance this path is Local even when remote peers drive outbound traffic on internet-facing eBPF proxies.\nAC:L - The race needs two concurrent sendmsg() calls on the same sockmap-attached source socket while a cached __SK_REDIRECT verdict still has nonzero apply_bytes; the attacker controls both racing threads locally or can reliably create them on a multi-threaded server with concurrent client requests.\nPR:N - The highest-impact reasonable deployment is an internet-facing Cilium/service-mesh node with pre-installed sockmap SK_MSG redirect programs; an unauthenticated remote client can trigger concurrent outbound sends on enrolled sockets without any privileges on the victim host, while self-setup only raises the bar to CAP_NET_ADMIN in a user namespace.\nUI:N - Exploitation requires only network traffic to a vulnerable proxy or the attacker\u0027s own concurrent sendmsg threads; no victim user action such as mounting filesystems, opening files, or clicking links is needed.\nS:U - The slab use-after-free corrupts a struct sock in the host kernel security authority and enables standard kernel memory corruption or privilege escalation; it does not by itself cross VM, IOMMU, or container sandbox boundaries.\nC:H - KASAN reported slab-use-after-free in tcp_bpf_sendmsg_redir() with an 8-byte read through a freed struct sock; reclaiming that socket object enables attacker-controlled contents and arbitrary kernel memory disclosure via subsequent dereferences.\nI:H - Use-after-free on struct sock provides groomable heap control over sk_prot and callback pointers in tcp_bpf_sendmsg_redir(), yielding standard kernel UAF write primitives usable for arbitrary modification and privilege escalation.\nA:H - The published KASAN trace shows deterministic slab-use-after-free during send verdict redirect processing; UAF on struct sock can oops or panic the kernel during dereference even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:16.327Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3"
        },
        {
          "url": "https://git.kernel.org/stable/c/90a19b0894ba79a699b48cf44421b36fbd566e99"
        },
        {
          "url": "https://git.kernel.org/stable/c/d192cff2a37d59206dabe6ec2e60ceac6271f274"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10"
        },
        {
          "url": "https://git.kernel.org/stable/c/1cec526cf0a2227395f2c2f4b671cb052ff0b00e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a76624733730e541e4955fdecf506af2f6b20558"
        }
      ],
      "title": "bpf, sockmap: Fix sk_redir use-after-free in send verdict",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74589",
    "datePublished": "2026-08-22T15:31:41.177Z",
    "dateReserved": "2026-08-15T05:44:03.918Z",
    "dateUpdated": "2026-08-25T05:40:16.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/verity/measure.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1344b632cb5043e32939a84568125719111c5af3",
              "status": "affected",
              "version": "67814c00de3161181cddd06c77aeaf86ac4cc584",
              "versionType": "git"
            },
            {
              "lessThan": "2a5cfcad1d56e26d645b7887b0ed24c371851525",
              "status": "affected",
              "version": "67814c00de3161181cddd06c77aeaf86ac4cc584",
              "versionType": "git"
            },
            {
              "lessThan": "5bd63cad9df4328a184c409fbdad4f17944bcdb8",
              "status": "affected",
              "version": "67814c00de3161181cddd06c77aeaf86ac4cc584",
              "versionType": "git"
            },
            {
              "lessThan": "3e8ec7c0387273329374f5c7bd61f5f38af71fe1",
              "status": "affected",
              "version": "67814c00de3161181cddd06c77aeaf86ac4cc584",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/verity/measure.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfsverity: Fix bpf_get_fsverity_digest() dynptr assumptions\n\nThe BPF verifier and the dynptr abstraction ensure that the memory space\nreferenced by a dynptr remains valid.  They do not, however, provide any\nguarantee that the contents of the memory are stable.  kfuncs are\nexpected to remain memory-safe even if concurrent modifications occur.\n\nbpf_get_fsverity_digest() didn\u0027t follow that: it could crash if\narg-\u003edigest_size was concurrently modified.\n\nFix that by using the known-good value hash_alg-\u003edigest_size instead.\n\nAlso widen \u0027dynptr_sz\u0027 and \u0027out_digest_sz\u0027 to u64 to match the return\ntype of __bpf_dynptr_size().  It doesn\u0027t appear that it can actually be\nmore than INT_MAX currently (since __bpf_dynptr_data_rw() excludes\nfile-based pointers), but the correct type might as well be used."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is only reachable via bpf_get_fsverity_digest(), a BPF kfunc callable from BPF LSM programs loaded through the bpf(2) syscall and triggered by local LSM hooks such as file_open, not by any network-facing kernel service.\nAC:L - Exploitation requires racing concurrent writes to the dynptr-backed fsverity_digest buffer (e.g., bpf_map_update_elem from a sibling thread) against the kfunc\u0027s memset; the attacker controls both sides of this race and can repeat it until the bad offset is hit.\nPR:L - Loading and attaching the required BPF LSM program needs CAP_BPF and CAP_PERFMON, which an unprivileged user can obtain as root inside a user namespace (unshare -Ur) without init-namespace privileges, matching kernel CNA guidance for BPF reachability.\nUI:N - No victim interaction is required; the attacker can load the LSM program, prepare a shared dynptr buffer, enable fsverity on a file they own, and trigger file_open themselves to invoke the vulnerable kfunc.\nS:U - Successful exploitation corrupts kernel heap memory and can yield local privilege escalation within the same kernel/host security boundary; it does not by itself cross a guest-to-host, sandbox, or IOMMU isolation boundary.\nC:H - Concurrent tampering with digest_size lets memset() use an attacker-chosen offset beyond the dynptr allocation, causing out-of-bounds kernel heap writes that can corrupt adjacent objects and be leveraged for arbitrary kernel memory disclosure.\nI:H - The faulty memset() can write large zeroed regions far outside the dynptr buffer, giving a controllable out-of-bounds heap write primitive that is exploitable for control-flow hijacking and arbitrary kernel code execution.\nA:H - An out-of-bounds heap write from kernel context can immediately oops/panic the kernel or destabilize critical structures, and the underlying memory corruption reliably threatens system availability even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:17.568Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1344b632cb5043e32939a84568125719111c5af3"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a5cfcad1d56e26d645b7887b0ed24c371851525"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bd63cad9df4328a184c409fbdad4f17944bcdb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e8ec7c0387273329374f5c7bd61f5f38af71fe1"
        }
      ],
      "title": "fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74590",
    "datePublished": "2026-08-22T15:31:41.929Z",
    "dateReserved": "2026-08-15T05:44:03.918Z",
    "dateUpdated": "2026-08-25T05:40:17.568Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/integrity/ima/ima_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f46705d96eb60587aa7035acfcbec977e08d620",
              "status": "affected",
              "version": "3323eec921efd815178a23107ab63588c605c0b2",
              "versionType": "git"
            },
            {
              "lessThan": "dd21c96a71e876c8df9ec546b885a2c5f47bbb05",
              "status": "affected",
              "version": "3323eec921efd815178a23107ab63588c605c0b2",
              "versionType": "git"
            },
            {
              "lessThan": "0baed1fa2184c81e4baf76f445d3faa4b738c8f7",
              "status": "affected",
              "version": "3323eec921efd815178a23107ab63588c605c0b2",
              "versionType": "git"
            },
            {
              "lessThan": "b80bed5c871a80151351342c065579405ce77145",
              "status": "affected",
              "version": "3323eec921efd815178a23107ab63588c605c0b2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/integrity/ima/ima_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: Instantiate file_truncate and path_truncate hooks\n\nInstantiate the file_truncate and path_truncate LSM hooks to reset the\naction cache flags (IMA_DONE_MASK) as soon as truncation is requested,\nso the file, based on policy, is re-collected, re-measured, re-audited,\nand re-appraised on next access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The missing IMA hook is hit from vfs_truncate() via truncate/ftruncate/O_TRUNC syscalls and from ksmbd vfs_truncate on TCP/445; on IMA-enforced servers a remote SMB client with write access can truncate appraised files without clearing IMA_DONE_MASK, the highest-impact reachable path.\nAC:L - Once IMA policy is active, an attacker with write access can deterministically truncate a target file; security_path_truncate/file_truncate always run before do_truncate, so stale IMA_DONE_MASK persists reliably with no races or special memory layout.\nPR:L - Exploitation requires only standard file write permission (MAY_WRITE) on the target inode\u2014via local truncate/ftruncate or an authenticated ksmbd/NFS client with write ACL\u2014not real root or init-namespace capabilities beyond normal write access to the appraised file.\nUI:N - The attacker directly issues truncate/ftruncate or remote SETATTR/truncate operations; no victim must mount media, open a file, or perform any separate action beyond the attacker\u0027s own write/truncate request.\nS:U - The flaw defeats IMA measurement/appraisal caching within the same kernel integrity authority; it does not cross VM, hypervisor, IOMMU, or container sandbox boundaries.\nC:H - Stale IMA_APPRAISED flags let process_measurement() skip re-appraisal on exec/open, so attacker-modified truncated content in hash-appraised executables runs with a cached pass and can access any data reachable by that code.\nI:H - Without clearing IMA_DONE_MASK on truncation, modified file content retains cached IMA_MEASURED/IMA_APPRAISED state and bypasses re-measurement, re-audit, and re-appraisal, defeating the core IMA integrity guarantee for affected files.\nA:N - The bug is a stale-cache integrity bypass with no kernel memory corruption, oops, panic, hang, or deadlock; truncation may change individual file availability but does not inherently crash or deny the host kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:20.017Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f46705d96eb60587aa7035acfcbec977e08d620"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd21c96a71e876c8df9ec546b885a2c5f47bbb05"
        },
        {
          "url": "https://git.kernel.org/stable/c/0baed1fa2184c81e4baf76f445d3faa4b738c8f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b80bed5c871a80151351342c065579405ce77145"
        }
      ],
      "title": "ima: Instantiate file_truncate and path_truncate hooks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74592",
    "datePublished": "2026-08-22T15:31:43.419Z",
    "dateReserved": "2026-08-15T05:44:03.919Z",
    "dateUpdated": "2026-08-25T05:40:20.017Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/psi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4addb102154b7cf6e2310ccbe20c3c08619e520d",
              "status": "affected",
              "version": "6bfcb6178925b1fd28c102e53d403091b8f49396",
              "versionType": "git"
            },
            {
              "lessThan": "894a9300d7fb2e2951da92e565ae6de7ddfb0a69",
              "status": "affected",
              "version": "8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83",
              "versionType": "git"
            },
            {
              "lessThan": "1e5ca82eee59caca6988f9d6e859786aab8a5fa0",
              "status": "affected",
              "version": "8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83",
              "versionType": "git"
            },
            {
              "lessThan": "310b5a537a78c358a4cd244bd767c1a517a05459",
              "status": "affected",
              "version": "8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83",
              "versionType": "git"
            },
            {
              "lessThan": "806fcff98c1d7cb3c1dc0015e55ebdbe819e6b08",
              "status": "affected",
              "version": "8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83",
              "versionType": "git"
            },
            {
              "lessThan": "8037c5b2b2a447df52542f4d8535895d837bdcbd",
              "status": "affected",
              "version": "8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83",
              "versionType": "git"
            },
            {
              "lessThan": "611e7821c4f83a671455658797336faecc3a5196",
              "status": "affected",
              "version": "8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83",
              "versionType": "git"
            },
            {
              "lessThan": "5457025fa8ca3c0d2732109513de839e3e797190",
              "status": "affected",
              "version": "8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e1e5e263bbe0e6e9c3db36aa48a3c8acf546fa49",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "979965c33f734a1666af67900408f997ac669c23",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.266",
              "status": "affected",
              "version": "5.10.50",
              "versionType": "semver"
            },
            {
              "lessThan": "5.13",
              "status": "affected",
              "version": "5.12.17",
              "versionType": "semver"
            },
            {
              "lessThan": "5.14",
              "status": "affected",
              "version": "5.13.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/psi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.10.50",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.12.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.13.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/psi: Shut down rtpoll_timer in psi_cgroup_free()\n\npsi_schedule_rtpoll_work() is called locklessly from the scheduler hotpath\nand can race psi_trigger_destroy() taking down the last rtpoll trigger under\nrtpoll_trigger_lock:\n\n  psi_schedule_rtpoll_work()        psi_trigger_destroy()\n\n  rcu_read_lock();\n  task = rcu_dereference(rtpoll_task);\n                                    rcu_assign_pointer(rtpoll_task, NULL);\n                                    timer_delete(\u0026rtpoll_timer);\n  mod_timer(\u0026rtpoll_timer, ...);\n  rcu_read_unlock();\n                                    synchronize_rcu();\n                                    kthread_stop(task_to_destroy);\n\nThe group can then be freed with the re-armed timer still pending, and\npoll_timer_fn() runs on freed memory.\n\n461daba06bdc (\"psi: eliminate kthread_worker from psi trigger scheduling\nmechanism\") deleted the timer synchronously after the synchronize_rcu(),\nwhich prevented this but raced trigger creation instead: the deletion could\ncancel the timer that a new trigger set armed during the grace period and,\nas creation also reinitialized the timer at the time, corrupt it.\n8f91efd870ea (\"psi: Fix race between psi_trigger_create/destroy\") moved the\ninitialization into group_init() and the deletion into the locked section,\ntrading the creation races for the window above.\n\nNeither placement in the destruction path works. A pending timer firing\nwhile the group is alive is harmless though. poll_timer_fn() just wakes the\nrtpoll waitqueue and doesn\u0027t re-arm itself. Bind the timer to the group\u0027s\nlifetime instead and shut it down in psi_cgroup_free(). Nothing can arm it\nby then. timer_shutdown_sync() because the timer is never armed again."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachable only via local kernel interfaces: writing cgroup *.pressure or /proc/pressure/*, closing the trigger fd, and removing the cgroup; the race involves scheduler hotpath callbacks, not any network protocol.\nAC:L - The attacker controls both race participants\u2014closing/destroying the last privileged PSI trigger while concurrently driving psi_schedule_rtpoll_work() via cgroup task scheduling or the psimon worker\u2014so the mod_timer-after-timer_delete window is reliably winnable.\nPR:L - The vulnerable rtpoll path requires CAP_SYS_RESOURCE (non-2s PSI windows); that capability is available to an unprivileged user who creates a user namespace, and cgroup pressure files are writable under delegated cgroup v2 hierarchies in that namespace.\nUI:N - Exploitation is fully self-driven: the attacker creates the trigger, races its teardown against scheduler activity, and deletes the cgroup; no separate victim action such as mounting a filesystem or opening a file is required.\nS:U - Impact is confined to kernel memory corruption and potential local privilege escalation within the same kernel security authority; it does not cross a VM, container runtime, or IOMMU trust boundary.\nC:H - After psi_cgroup_free() the pending rtpoll_timer fires poll_timer_fn() on a freed psi_group, a classic use-after-free that can expose or corrupt adjacent slab contents and be developed into arbitrary kernel memory read primitives.\nI:H - poll_timer_fn() performs atomic_set() on group-\u003ertpoll_wakeup and wake_up_interruptible() on group-\u003ertpoll_wait after the psi_group is freed, giving attacker-influenced writes into a recycled kmem object suitable for control-flow hijacking.\nA:H - Timer execution on freed psi_group memory can cause immediate kernel oops/panic from invalid pointer dereferences or list corruption, and the race can be retriggered for sustained denial of service on shared cloud/container hosts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:21.246Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4addb102154b7cf6e2310ccbe20c3c08619e520d"
        },
        {
          "url": "https://git.kernel.org/stable/c/894a9300d7fb2e2951da92e565ae6de7ddfb0a69"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e5ca82eee59caca6988f9d6e859786aab8a5fa0"
        },
        {
          "url": "https://git.kernel.org/stable/c/310b5a537a78c358a4cd244bd767c1a517a05459"
        },
        {
          "url": "https://git.kernel.org/stable/c/806fcff98c1d7cb3c1dc0015e55ebdbe819e6b08"
        },
        {
          "url": "https://git.kernel.org/stable/c/8037c5b2b2a447df52542f4d8535895d837bdcbd"
        },
        {
          "url": "https://git.kernel.org/stable/c/611e7821c4f83a671455658797336faecc3a5196"
        },
        {
          "url": "https://git.kernel.org/stable/c/5457025fa8ca3c0d2732109513de839e3e797190"
        }
      ],
      "title": "sched/psi: Shut down rtpoll_timer in psi_cgroup_free()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74594",
    "datePublished": "2026-08-22T15:31:44.894Z",
    "dateReserved": "2026-08-15T05:44:03.919Z",
    "dateUpdated": "2026-08-25T05:40:21.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/crypto/policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "174633a468817a49bd474bcfc9067c84e54efe68",
              "status": "affected",
              "version": "14f3db5542e62bcf6fe088a09760ac52d55306c5",
              "versionType": "git"
            },
            {
              "lessThan": "0baeb730044981f5ec5fb7d62a3763835ea606f6",
              "status": "affected",
              "version": "14f3db5542e62bcf6fe088a09760ac52d55306c5",
              "versionType": "git"
            },
            {
              "lessThan": "33b7e810ce09955aa02f3b632455cf5e7ac990a9",
              "status": "affected",
              "version": "14f3db5542e62bcf6fe088a09760ac52d55306c5",
              "versionType": "git"
            },
            {
              "lessThan": "6a67c460b12315033268dce597546984fe5739e7",
              "status": "affected",
              "version": "14f3db5542e62bcf6fe088a09760ac52d55306c5",
              "versionType": "git"
            },
            {
              "lessThan": "653e888a24c87b8bbeab44d7e558a1c1a3641088",
              "status": "affected",
              "version": "14f3db5542e62bcf6fe088a09760ac52d55306c5",
              "versionType": "git"
            },
            {
              "lessThan": "98516ba8b817f34e86bdd7a5b7a383cff75c3ddf",
              "status": "affected",
              "version": "14f3db5542e62bcf6fe088a09760ac52d55306c5",
              "versionType": "git"
            },
            {
              "lessThan": "cf6c993c0feca7984797e634deba3c80342e199a",
              "status": "affected",
              "version": "14f3db5542e62bcf6fe088a09760ac52d55306c5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/crypto/policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()\n\nfscrypt_ioctl_set_policy() calls inode_owner_or_capable() with\n\u0026nop_mnt_idmap before allowing an encryption policy to be set, instead\nof the idmap of the mount the ioctl was issued on.\n\nfscrypt is used by filesystems that support idmapped mounts (e.g. ext4,\nf2fs), so on such a mount this compares the caller\u0027s fsuid against the\nunmapped on-disk owner rather than the mapped owner: the actual owner\ncan be wrongly denied with -EACCES and an unrelated caller wrongly\nallowed.  Use file_mnt_idmap(filp) instead."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a local process to open a directory on an idmapped ext4/f2fs filesystem and issue FS_IOC_SET_ENCRYPTION_POLICY via ioctl(); there is no network, adjacent-radio, or physical-device attack path to the vulnerable fscrypt_ioctl_set_policy() check.\nAC:L - On idmapped mounts the UID mismatch is structural, not random: any local user whose fsuid equals the inode\u0027s unmapped on-disk owner can open an empty victim directory, add their own fscrypt key, and trigger the ioctl without races or attacker-uncontrollable memory layout.\nPR:L - Only basic local user privileges are needed; the attacker must be able to open the target directory and call FS_IOC_ADD_ENCRYPTION_KEY plus FS_IOC_SET_ENCRYPTION_POLICY, with no real-root or init-namespace capability required beyond normal DAC permissions on the path.\nUI:N - Exploitation requires no action by the victim; the attacker alone issues the ioctl on an empty directory they can open, and the authorization bypass occurs entirely within the attacker\u0027s own syscall sequence.\nS:U - This is an incorrect inode_owner_or_capable() authorization check in the kernel fscrypt ioctl path on idmapped mounts; impact stays within the same kernel security authority and does not constitute VM escape, hypervisor bypass, or IOMMU boundary crossing.\nC:H - A wrongly authorized attacker can bind a victim\u0027s empty directory to an attacker-controlled fscrypt master key, then decrypt any sensitive files the victim later creates there, giving broad read access to victim data rather than a small bounded leak.\nI:H - The ioctl persistently modifies filesystem encryption policy and on-disk fscrypt context for a directory the attacker does not own, granting unauthorized control over a critical security property of victim data at rest.\nA:H - The bug both wrongly denies legitimate directory owners with -EACCES and lets attackers encrypt a victim\u0027s empty directory with an attacker-held key, preventing the real owner from using or recovering that directory and its future contents."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:22.483Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/174633a468817a49bd474bcfc9067c84e54efe68"
        },
        {
          "url": "https://git.kernel.org/stable/c/0baeb730044981f5ec5fb7d62a3763835ea606f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/33b7e810ce09955aa02f3b632455cf5e7ac990a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a67c460b12315033268dce597546984fe5739e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/653e888a24c87b8bbeab44d7e558a1c1a3641088"
        },
        {
          "url": "https://git.kernel.org/stable/c/98516ba8b817f34e86bdd7a5b7a383cff75c3ddf"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf6c993c0feca7984797e634deba3c80342e199a"
        }
      ],
      "title": "fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74595",
    "datePublished": "2026-08-22T15:31:45.649Z",
    "dateReserved": "2026-08-15T05:44:03.919Z",
    "dateUpdated": "2026-08-25T05:40:22.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_tunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "44fe898df302e91c5ee5acbc71ffa74e78e6c183",
              "status": "affected",
              "version": "e490d1d85cf5e191791979e5f260d32eb4f703a8",
              "versionType": "git"
            },
            {
              "lessThan": "0dadb0620ab65949a8bc2439dd28ea3c942fe87d",
              "status": "affected",
              "version": "e490d1d85cf5e191791979e5f260d32eb4f703a8",
              "versionType": "git"
            },
            {
              "lessThan": "b6816536a2990c0db44a26130a03e40b441e829b",
              "status": "affected",
              "version": "e490d1d85cf5e191791979e5f260d32eb4f703a8",
              "versionType": "git"
            },
            {
              "lessThan": "64e41736a26f37ab6215bc2e6df125df05aceb08",
              "status": "affected",
              "version": "e490d1d85cf5e191791979e5f260d32eb4f703a8",
              "versionType": "git"
            },
            {
              "lessThan": "484134e1eb07d700a73b1e4bbf3fb503e299be60",
              "status": "affected",
              "version": "e490d1d85cf5e191791979e5f260d32eb4f703a8",
              "versionType": "git"
            },
            {
              "lessThan": "4eb15c465337b18f44716c499cd6ad63eee0ad54",
              "status": "affected",
              "version": "e490d1d85cf5e191791979e5f260d32eb4f703a8",
              "versionType": "git"
            },
            {
              "lessThan": "fbf40faa0414b753212494ad197542002e66ed9e",
              "status": "affected",
              "version": "e490d1d85cf5e191791979e5f260d32eb4f703a8",
              "versionType": "git"
            },
            {
              "lessThan": "f803c086399da277b5d0ff36a107d0f162751800",
              "status": "affected",
              "version": "e490d1d85cf5e191791979e5f260d32eb4f703a8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_tunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.22"
            },
            {
              "lessThan": "2.6.22",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: clear skb2-\u003ecb[] in ip6ip6_err()\n\nip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the\nquoted inner IPv6 packet, and then passes the clone to icmpv6_send().\nThe clone still carries the outer packet\u0027s inet6_skb_parm in skb-\u003ecb.\n\nIf the outer packet had a Home Address Option, IP6CB(skb2)-\u003edsthao\nremains non-zero after skb_pull(). icmpv6_send() later calls\nmip6_addr_swap(), which uses that stale dsthao offset against the quoted\ninner packet. A malformed inner destination-options header can then make\nthe HAO lookup and address swap run past the end of the quoted packet\nand corrupt skb_shared_info.\n\nClear skb2-\u003ecb[] before pulling the quoted inner IPv6 packet so the\nreply path does not reuse metadata left by the outer IPv6 stack."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached when a remote peer sends a forged ICMPv6 error whose quoted payload is an IPv6-in-IPv6 tunnel datagram; processing follows the normal IPv6 receive path (ipv6_rcv -\u003e icmpv6_notify -\u003e tunnel6_err -\u003e ip6ip6_err) with no local access required.\nAC:L - The attacker controls the carrier IPv6 Home Address Option, quoted tunnel/inner headers, and ICMP error type; once an ip6tnl endpoint exists (normal for this subsystem), triggering the stale-dsthao path is reliable and needs no races or victim interaction.\nPR:N - No authentication or capabilities are required on the target; unprivileged remote senders can deliver crafted ICMPv6 errors that the kernel processes on the standard pre-auth receive path (INET6_PROTO_NOPOLICY).\nUI:N - Exploitation requires only delivering a malicious network packet; no victim must open files, click links, or perform any other action.\nS:U - Impact is in-kernel memory corruption on the receiving host within the same security authority; it does not by itself cross VM, container, or IOMMU boundaries.\nC:H - With CONFIG_IPV6_MIP6, mip6_addr_swap() uses the stale dsthao offset to scan the quoted inner packet and can read attacker-controlled bytes past the skb tail while resolving a fake HAO TLV before swapping addresses.\nI:H - The resulting 16-byte swap(iph-\u003esaddr, hao-\u003eaddr) can write beyond the quoted packet into skb_shared_info, giving attacker-influenced heap corruption suitable for further control-flow or data manipulation.\nA:H - Corrupting skb_shared_info from the network input path can cause kernel oops/panic or otherwise deny service on IPv6 tunnel endpoints, and the condition is repeatable with crafted packets."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:23.709Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/44fe898df302e91c5ee5acbc71ffa74e78e6c183"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dadb0620ab65949a8bc2439dd28ea3c942fe87d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6816536a2990c0db44a26130a03e40b441e829b"
        },
        {
          "url": "https://git.kernel.org/stable/c/64e41736a26f37ab6215bc2e6df125df05aceb08"
        },
        {
          "url": "https://git.kernel.org/stable/c/484134e1eb07d700a73b1e4bbf3fb503e299be60"
        },
        {
          "url": "https://git.kernel.org/stable/c/4eb15c465337b18f44716c499cd6ad63eee0ad54"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbf40faa0414b753212494ad197542002e66ed9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f803c086399da277b5d0ff36a107d0f162751800"
        }
      ],
      "title": "ip6_tunnel: clear skb2-\u003ecb[] in ip6ip6_err()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74597",
    "datePublished": "2026-08-22T15:31:47.120Z",
    "dateReserved": "2026-08-15T05:44:03.919Z",
    "dateUpdated": "2026-08-25T05:40:23.709Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2f6f94eda12430fb41b24b44a71e2ea4e93561d7",
              "status": "affected",
              "version": "70ceb4f53929f73746be72f73707cd9f8753e2fc",
              "versionType": "git"
            },
            {
              "lessThan": "7eac87396c44a312be457ef41d4c5687883be9a2",
              "status": "affected",
              "version": "70ceb4f53929f73746be72f73707cd9f8753e2fc",
              "versionType": "git"
            },
            {
              "lessThan": "7309529f257ae18e72112ef9f614edfd6df229bb",
              "status": "affected",
              "version": "70ceb4f53929f73746be72f73707cd9f8753e2fc",
              "versionType": "git"
            },
            {
              "lessThan": "0b9e02f3bd31c888f2ccdc0ca08e546d6abe9c4d",
              "status": "affected",
              "version": "70ceb4f53929f73746be72f73707cd9f8753e2fc",
              "versionType": "git"
            },
            {
              "lessThan": "ff3cb05289b8a4ef95fa7ea14c7d34818359edbb",
              "status": "affected",
              "version": "70ceb4f53929f73746be72f73707cd9f8753e2fc",
              "versionType": "git"
            },
            {
              "lessThan": "3b2231e358d26e3aec5d8040b1fb777af03c5f05",
              "status": "affected",
              "version": "70ceb4f53929f73746be72f73707cd9f8753e2fc",
              "versionType": "git"
            },
            {
              "lessThan": "da64ed1f346ba84df574d6469fa2e422b2511719",
              "status": "affected",
              "version": "70ceb4f53929f73746be72f73707cd9f8753e2fc",
              "versionType": "git"
            },
            {
              "lessThan": "d1ad8fb2ac6a1afb71dc22d9ae8efb4dda96c824",
              "status": "affected",
              "version": "70ceb4f53929f73746be72f73707cd9f8753e2fc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.17"
            },
            {
              "lessThan": "2.6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix Route Information option length validation\n\nrt6_route_rcv() validates the Route Information option (RFC 4191) length\nagainst the prefix length, but both checks are off by one.\n\nrinfo-\u003elength is the ND option length in units of 8 octets and it\n*includes* the 8-byte option header, so an option carrying N bytes of\nprefix has length == 1 + N/8.  RFC 4191 section 2.3 requires length 3\nwhen Prefix Length is greater than 64, and 2 or 3 when it is greater\nthan 0.  The code accepts length \u003e= 2 and length \u003e= 1 respectively.\n\nipv6_addr_prefix() then copies prefix_len/8 bytes out of rinfo-\u003eprefix,\nso a Router Advertisement with (prefix_len=128, length=2) or\n(prefix_len=64, length=1) makes the kernel read up to 8 bytes past the\nend of the option.  Those bytes end up in the prefix of the route that\ngets installed, so they are visible to userspace:\n\n  # RA with a Route Information option (prefix_len=128, length=2)\n  # followed by a source link-layer address option, 01 01 de ad be ef ca fe\n  $ ip -6 route show\n  2001:db8:dead:beef:101:dead:beef:cafe via fe80::1234 dev veth0 proto ra\n                     ^^^^^^^^^^^^^^^^^^ the next option, read out of bounds\n\nWhen the Route Information option is the last one in the packet, those\neight bytes come from the skb tail room instead.\n\nReject the option lengths RFC 4191 does not allow."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is reached from inbound ICMPv6 Router Advertisements on the standard IPv6 receive path (ip6_input\u2192icmpv6_rcv\u2192ndisc_rcv\u2192ndisc_router_discovery\u2192rt6_route_rcv), so a network peer can trigger it on hosts accepting RAs (phones, laptops, IoT, containers on shared L2).\nAC:L - Once the victim accepts non-zero Route Information prefixes, an attacker fully controls prefix_len and option length in forged RAs and can deterministically trigger the out-of-bounds read (up to 8 bytes) without races or uncontrollable memory layout.\nPR:N - Exploitation requires only sending crafted ICMPv6 RAs on the victim\u0027s link; the attacker needs no account, capabilities, or init-namespace root on the target, only the ability to inject ND traffic the host will process.\nUI:N - No victim user action is required beyond normal IPv6 connectivity; RA/Route Information processing runs automatically in the kernel when accept_ra and related sysctls permit it.\nS:U - Impact is confined to kernel IPv6 routing state leaking into the same host\u0027s userspace route table; it does not cross VM, container, or IOMMU security boundaries into a separate authority.\nC:H - ipv6_addr_prefix() performs an out-of-bounds read of up to eight bytes past the Route Information option (from following ND options or skb tailroom), and those kernel bytes are stored in the installed route prefix visible to userspace via netlink or ip -6 route.\nI:N - The bug is a bounded out-of-bounds read into a stack buffer followed by route installation; it does not corrupt kernel memory, enable arbitrary writes, or provide a demonstrated control-flow hijack primitive.\nA:N - The vulnerable path only mis-handles prefix extraction and installs a route with leaked bytes; it does not cause kernel oops, panic, hang, or demonstrated denial of service beyond incorrect route data."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:24.953Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2f6f94eda12430fb41b24b44a71e2ea4e93561d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/7eac87396c44a312be457ef41d4c5687883be9a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/7309529f257ae18e72112ef9f614edfd6df229bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b9e02f3bd31c888f2ccdc0ca08e546d6abe9c4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff3cb05289b8a4ef95fa7ea14c7d34818359edbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b2231e358d26e3aec5d8040b1fb777af03c5f05"
        },
        {
          "url": "https://git.kernel.org/stable/c/da64ed1f346ba84df574d6469fa2e422b2511719"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1ad8fb2ac6a1afb71dc22d9ae8efb4dda96c824"
        }
      ],
      "title": "ipv6: fix Route Information option length validation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74598",
    "datePublished": "2026-08-22T15:31:47.859Z",
    "dateReserved": "2026-08-15T05:44:03.919Z",
    "dateUpdated": "2026-08-25T05:40:24.953Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/pagewalk.c",
            "mm/ptdump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c0391b9a774cc0854f3152e484a9d4835b12b40",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "lessThan": "cbd9583bb6f70733d0022a66d3546a15c76ae744",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "lessThan": "76df4edf7d61ecb711bc517ff4c20a5e85c4e9f7",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "lessThan": "b9c6d048bdfaae78d7d921b454f7de7baefaa2f0",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "lessThan": "7f740664aec1f832953c2e6d9b8920cd6c8bcc0c",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "lessThan": "4adc4c9a9a43d61fe476dfe10811f3df2e7e4106",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "lessThan": "27c32e5538344b13c1505a08861e04620c125d47",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "31895cfd79564111cdd5a9f48c5d491ae26a238e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9c7f7bdb1932f8c1e5f80d32c717184701afe701",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "acdb4981644c8e31ccee294bdefff475c0cf587b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0454e2fad9306961540ee7e84da47a8e345b7d22",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.125",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.91",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.31",
              "versionType": "semver"
            },
            {
              "lessThan": "4.16",
              "status": "affected",
              "version": "4.15.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/pagewalk.c",
            "mm/ptdump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.125",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.91",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.15.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/ptdump: always stabilise against page table freeing using init_mm\n\nPrevious commits have established the invariant that kernel page table\nfreeing is performed while an mmap read lock on init_mm is held, which\nfixes races between ptdump and kernel page table freeing over init_mm.\n\nHowever, x86 and arm64 can perform a ptdump over an mm other than init_mm\nvia ptdump_walk_pgd() and since kernel memory ranges are shared across\nnon-kernel mm\u0027s, this means that the race still exists for these cases.\n\nFix this by acquiring a nested mmap write lock for init_mm in\nptdump_walk_pgd().\n\nThis is safe as we take this after mmap write locking the mm, and nothing\nacquires the init_mm lock first before locking an arbitrary mm, so no\ndeadlock is possible.\n\nAlso update walk_page_range_debug() to assert that init_mm is write\nlocked, add a comment explaining why and remove some redundant code, and\neliminate the unnecessary and confusing invocation of\nwalk_kernel_page_table_range().\n\nWe can safely remove the non-NULL check for walk.mm, as the mmap lock\nasserts would NULL pointer deref if it was (and of course no callers do\nthis).\n\nThe first point at which ptdump can race kernel page table freeing is\ncommit b6bdb7517c3d (\"mm/vmalloc: add interfaces to free unmapped page\ntable\"), so we target this in the Fixes tag."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:39.758Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c0391b9a774cc0854f3152e484a9d4835b12b40"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbd9583bb6f70733d0022a66d3546a15c76ae744"
        },
        {
          "url": "https://git.kernel.org/stable/c/76df4edf7d61ecb711bc517ff4c20a5e85c4e9f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9c6d048bdfaae78d7d921b454f7de7baefaa2f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f740664aec1f832953c2e6d9b8920cd6c8bcc0c"
        },
        {
          "url": "https://git.kernel.org/stable/c/4adc4c9a9a43d61fe476dfe10811f3df2e7e4106"
        },
        {
          "url": "https://git.kernel.org/stable/c/27c32e5538344b13c1505a08861e04620c125d47"
        }
      ],
      "title": "mm/ptdump: always stabilise against page table freeing using init_mm",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74599",
    "datePublished": "2026-08-22T15:31:48.604Z",
    "dateReserved": "2026-08-15T05:44:03.919Z",
    "dateUpdated": "2026-08-23T12:47:39.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "26662bc8fced1d668fa1aa146eda085bfc67bd0b",
              "status": "affected",
              "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990",
              "versionType": "git"
            },
            {
              "lessThan": "6b524e6b234e45c7f5f90d13b042c6f57f80105c",
              "status": "affected",
              "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990",
              "versionType": "git"
            },
            {
              "lessThan": "597f279b7b4a06412e3d965e98cc36e181cdbede",
              "status": "affected",
              "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990",
              "versionType": "git"
            },
            {
              "lessThan": "22709117d9ae95e52673685f98caac7c356a8227",
              "status": "affected",
              "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990",
              "versionType": "git"
            },
            {
              "lessThan": "ad7e10c7ea89af45ac1bf1814855d45da472703d",
              "status": "affected",
              "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990",
              "versionType": "git"
            },
            {
              "lessThan": "5b926fb04cb9ef3156dcf88c69a59d3d1a1c4f9f",
              "status": "affected",
              "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990",
              "versionType": "git"
            },
            {
              "lessThan": "5e6e2a18c20e88167d414f666032792e8bf19b80",
              "status": "affected",
              "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990",
              "versionType": "git"
            },
            {
              "lessThan": "f27bdc43077e4fcb5557dfc315ee8d91e741f483",
              "status": "affected",
              "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.5"
            },
            {
              "lessThan": "4.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Use current_context for safe per-CPU buffer swap\n\nThe ring_buffer_swap_cpu() function currently checks the per-CPU\ncommitting counter to determine if a buffer is actively being written to\nbefore performing the swap. However, there exists a race window where\nthis check can be bypassed:\n\n    ring_buffer_lock_reserve\n        cpu_buffer = buffer-\u003ebuffers[cpu];       // cpu_buffer_a\n        rb_reserve_next_event\n            rb_start_commit // inc committing\n            if (unlikely(READ_ONCE(cpu_buffer-\u003ebuffer) != buffer)) {...}\n            __rb_reserve_next\n                rb_move_tail\n                    rb_end_commit(cpu_buffer);   // dec committing =\u003e 0\n                    /* interrupt hits here, successfully swaps! */\n                    local_inc(\u0026cpu_buffer-\u003ecommitting);\n\n    ring_buffer_unlock_commit\n        cpu_buffer = buffer-\u003ebuffers[cpu];      // cpu_buffer_b\n        rb_commit\n            rb_end_commit\n            RB_WARN_ON(cpu_buffer, !local_read(\u0026cpu_buffer-\u003ecommitting))\n                                                // triggers warning\n\nThe committing counter can temporarily drop to 0 during a single write\noperation (within rb_move_tail), creating a window where swap can\nsucceed even though the write is still in progress. This leads to\ninconsistent buffer state and triggers the RB_WARN_ON in rb_commit().\n\nReplace the committing counter check with current_context checks, which\nare set at the entry of ring_buffer_lock_reserve() and remain valid\nthroughout the entire write operation, providing a reliable indicator of\nbuffer busy state during swap."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local tracefs writes to snapshot or latency tracers; ring_buffer_swap_cpu() is only reached from update_max_tr_single() via tracing_snapshot_write or irqsoff/preemptoff tracers, with no network, adjacent, or physical entry path.\nAC:L - The attacker controls both sides of the race by enabling irqsoff/preemptoff tracing or hammering per_cpu/*/snapshot while generating trace events that cross page boundaries, reliably hitting the rb_move_tail window where committing briefly drops to zero.\nPR:L - tracing_check_open_get_tr() enforces only LOCKDOWN_TRACEFS and DAC with no capable() check; tracefs gid= mounts, Android/Perfetto/ChromeOS tracing groups, and container user+mount namespaces routinely grant unprivileged local write access to snapshot and current_tracer.\nUI:N - The attacker enables tracers and triggers buffer swaps through their own tracefs writes and syscalls; no victim cooperation, unrelated user action, or third-party interaction is required.\nS:U - Impact is corrupted kernel ring-buffer metadata and WARN_ON within the same kernel security domain; this is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Swapping per-CPU buffers mid-write leaves ring_buffer_per_cpu page, tail, and commit state inconsistent across buffers; subsequent trace reads or commits can access wrong backing pages, constituting kernel-memory corruption with arbitrary-read potential.\nI:H - Mid-reservation buffer swap causes unlock_commit on the wrong cpu_buffer with mismatched tail/commit page pointers, corrupting ring-buffer page lists and write metadata in ways exploitable for heap corruption and control-flow manipulation.\nA:H - rb_end_commit() hits RB_WARN_ON triggering WARN_ON and disabling recording; corrupted ring-buffer page state from this swap race has caused kernel oops/panic in related ring_buffer_swap_cpu bugs, and panic_on_warn makes the WARN fatal."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:26.170Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/26662bc8fced1d668fa1aa146eda085bfc67bd0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b524e6b234e45c7f5f90d13b042c6f57f80105c"
        },
        {
          "url": "https://git.kernel.org/stable/c/597f279b7b4a06412e3d965e98cc36e181cdbede"
        },
        {
          "url": "https://git.kernel.org/stable/c/22709117d9ae95e52673685f98caac7c356a8227"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad7e10c7ea89af45ac1bf1814855d45da472703d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b926fb04cb9ef3156dcf88c69a59d3d1a1c4f9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e6e2a18c20e88167d414f666032792e8bf19b80"
        },
        {
          "url": "https://git.kernel.org/stable/c/f27bdc43077e4fcb5557dfc315ee8d91e741f483"
        }
      ],
      "title": "ring-buffer: Use current_context for safe per-CPU buffer swap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74601",
    "datePublished": "2026-08-22T15:31:50.092Z",
    "dateReserved": "2026-08-15T05:44:03.919Z",
    "dateUpdated": "2026-08-25T05:40:26.170Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7c620d89bae1a926ab7d626600285d3516c9f3c4",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "2e37f2bf111429fbfa4d985b12df3ba496ca70aa",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "3b3e0a6ee5bb3ac000f135beef26b2b7ed1a771a",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "6d014e44b68ddd43f71288d2a4dbb1a259869149",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()\n\nIn rb_allocate_cpu_buffer(), bpage-\u003eorder was omitted, leaving it as 0.\nThis is an issue for a ring-buffer with subbufs bigger than PAGE_SIZE if\nwhen freed: free_buffer_page() relies on this value. Align the value\nwith the actual allocation size (buffer::subbuf_order)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:43.108Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7c620d89bae1a926ab7d626600285d3516c9f3c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e37f2bf111429fbfa4d985b12df3ba496ca70aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b3e0a6ee5bb3ac000f135beef26b2b7ed1a771a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d014e44b68ddd43f71288d2a4dbb1a259869149"
        }
      ],
      "title": "ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74602",
    "datePublished": "2026-08-22T15:31:50.811Z",
    "dateReserved": "2026-08-15T05:44:03.919Z",
    "dateUpdated": "2026-08-23T12:47:43.108Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}