Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1090
Vulnerability from certfr_avis - Published: 2026-08-28 - Updated: 2026-08-28
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian trixie versions ant\u00e9rieures \u00e0 6.12.105-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-74632",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74632"
},
{
"name": "CVE-2026-74452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74452"
},
{
"name": "CVE-2026-74649",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74649"
},
{
"name": "CVE-2026-74441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74441"
},
{
"name": "CVE-2026-68480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68480"
},
{
"name": "CVE-2026-74517",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74517"
},
{
"name": "CVE-2026-74450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74450"
},
{
"name": "CVE-2026-74481",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74481"
},
{
"name": "CVE-2026-68138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68138"
},
{
"name": "CVE-2026-74597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74597"
},
{
"name": "CVE-2026-74669",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74669"
},
{
"name": "CVE-2026-74482",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74482"
},
{
"name": "CVE-2026-74598",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74598"
},
{
"name": "CVE-2026-74540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74540"
},
{
"name": "CVE-2026-74440",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74440"
},
{
"name": "CVE-2026-74502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74502"
},
{
"name": "CVE-2026-53092",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53092"
},
{
"name": "CVE-2026-74599",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74599"
},
{
"name": "CVE-2026-74569",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74569"
},
{
"name": "CVE-2026-74581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74581"
},
{
"name": "CVE-2026-74543",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74543"
},
{
"name": "CVE-2026-74696",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74696"
},
{
"name": "CVE-2026-74612",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74612"
},
{
"name": "CVE-2026-74563",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74563"
},
{
"name": "CVE-2026-74457",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74457"
},
{
"name": "CVE-2026-74505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74505"
},
{
"name": "CVE-2026-74523",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74523"
},
{
"name": "CVE-2026-74453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74453"
},
{
"name": "CVE-2026-74693",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74693"
},
{
"name": "CVE-2026-74557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74557"
},
{
"name": "CVE-2026-74607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74607"
},
{
"name": "CVE-2026-74461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74461"
},
{
"name": "CVE-2026-74514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74514"
},
{
"name": "CVE-2026-68132",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68132"
},
{
"name": "CVE-2026-74465",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74465"
},
{
"name": "CVE-2026-74630",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74630"
},
{
"name": "CVE-2026-74682",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74682"
},
{
"name": "CVE-2026-74488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74488"
},
{
"name": "CVE-2026-74683",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74683"
},
{
"name": "CVE-2025-40054",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40054"
},
{
"name": "CVE-2026-74444",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74444"
},
{
"name": "CVE-2026-74724",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74724"
},
{
"name": "CVE-2026-74657",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74657"
},
{
"name": "CVE-2026-74676",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74676"
},
{
"name": "CVE-2026-74460",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74460"
},
{
"name": "CVE-2026-74586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74586"
},
{
"name": "CVE-2026-64017",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64017"
},
{
"name": "CVE-2026-68276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68276"
},
{
"name": "CVE-2026-74661",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74661"
},
{
"name": "CVE-2026-74688",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74688"
},
{
"name": "CVE-2026-74572",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74572"
},
{
"name": "CVE-2026-74726",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74726"
},
{
"name": "CVE-2026-74531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74531"
},
{
"name": "CVE-2026-74549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74549"
},
{
"name": "CVE-2026-68267",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68267"
},
{
"name": "CVE-2026-74470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74470"
},
{
"name": "CVE-2026-74478",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74478"
},
{
"name": "CVE-2026-74566",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74566"
},
{
"name": "CVE-2026-68166",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68166"
},
{
"name": "CVE-2026-74473",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74473"
},
{
"name": "CVE-2026-74467",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74467"
},
{
"name": "CVE-2026-74476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74476"
},
{
"name": "CVE-2026-74691",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74691"
},
{
"name": "CVE-2026-74490",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74490"
},
{
"name": "CVE-2026-74730",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74730"
},
{
"name": "CVE-2026-68169",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68169"
},
{
"name": "CVE-2026-74580",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74580"
},
{
"name": "CVE-2026-74565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74565"
},
{
"name": "CVE-2026-74660",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74660"
},
{
"name": "CVE-2026-74454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74454"
},
{
"name": "CVE-2026-74493",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74493"
},
{
"name": "CVE-2026-74463",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74463"
},
{
"name": "CVE-2026-74583",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74583"
},
{
"name": "CVE-2026-74725",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74725"
},
{
"name": "CVE-2026-74665",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74665"
},
{
"name": "CVE-2026-74464",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74464"
},
{
"name": "CVE-2026-74636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74636"
},
{
"name": "CVE-2026-74522",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74522"
},
{
"name": "CVE-2026-74704",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74704"
},
{
"name": "CVE-2026-74689",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74689"
},
{
"name": "CVE-2026-74710",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74710"
},
{
"name": "CVE-2026-74622",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74622"
},
{
"name": "CVE-2026-74474",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74474"
},
{
"name": "CVE-2026-74604",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74604"
},
{
"name": "CVE-2026-74451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74451"
},
{
"name": "CVE-2026-74555",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74555"
},
{
"name": "CVE-2026-74623",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74623"
},
{
"name": "CVE-2026-74456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74456"
},
{
"name": "CVE-2026-74535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74535"
},
{
"name": "CVE-2026-74552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74552"
},
{
"name": "CVE-2026-74714",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74714"
},
{
"name": "CVE-2026-74664",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74664"
},
{
"name": "CVE-2026-74445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74445"
},
{
"name": "CVE-2026-43197",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43197"
},
{
"name": "CVE-2026-74620",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74620"
},
{
"name": "CVE-2026-74732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74732"
},
{
"name": "CVE-2026-74499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74499"
},
{
"name": "CVE-2026-74675",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74675"
},
{
"name": "CVE-2026-74685",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74685"
},
{
"name": "CVE-2026-74701",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74701"
},
{
"name": "CVE-2026-74670",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74670"
},
{
"name": "CVE-2026-74504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74504"
},
{
"name": "CVE-2026-74637",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74637"
},
{
"name": "CVE-2026-74447",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74447"
},
{
"name": "CVE-2026-74536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74536"
},
{
"name": "CVE-2026-74589",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74589"
},
{
"name": "CVE-2026-74479",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74479"
},
{
"name": "CVE-2026-74492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74492"
},
{
"name": "CVE-2026-74641",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74641"
},
{
"name": "CVE-2026-68159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68159"
},
{
"name": "CVE-2026-74694",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74694"
},
{
"name": "CVE-2026-68367",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68367"
},
{
"name": "CVE-2026-74614",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74614"
},
{
"name": "CVE-2026-74442",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74442"
},
{
"name": "CVE-2026-68273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68273"
},
{
"name": "CVE-2026-74684",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74684"
},
{
"name": "CVE-2026-74608",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74608"
},
{
"name": "CVE-2026-74484",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74484"
},
{
"name": "CVE-2026-74459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74459"
},
{
"name": "CVE-2026-74471",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74471"
},
{
"name": "CVE-2026-74553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74553"
},
{
"name": "CVE-2026-74671",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74671"
},
{
"name": "CVE-2026-74515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74515"
},
{
"name": "CVE-2026-74448",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74448"
},
{
"name": "CVE-2026-74592",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74592"
},
{
"name": "CVE-2026-64586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64586"
},
{
"name": "CVE-2026-74609",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74609"
},
{
"name": "CVE-2026-74487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74487"
},
{
"name": "CVE-2026-74668",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74668"
},
{
"name": "CVE-2026-74500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74500"
},
{
"name": "CVE-2026-74618",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74618"
},
{
"name": "CVE-2026-74498",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74498"
},
{
"name": "CVE-2026-74615",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74615"
},
{
"name": "CVE-2026-74524",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74524"
},
{
"name": "CVE-2026-74625",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74625"
},
{
"name": "CVE-2026-68264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68264"
},
{
"name": "CVE-2026-74446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74446"
},
{
"name": "CVE-2026-74577",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74577"
},
{
"name": "CVE-2026-74516",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74516"
},
{
"name": "CVE-2026-74590",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74590"
},
{
"name": "CVE-2026-74541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74541"
},
{
"name": "CVE-2026-74574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74574"
},
{
"name": "CVE-2026-74567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74567"
},
{
"name": "CVE-2026-74619",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74619"
},
{
"name": "CVE-2026-74582",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74582"
},
{
"name": "CVE-2026-74519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74519"
},
{
"name": "CVE-2026-74548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74548"
},
{
"name": "CVE-2026-74718",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74718"
},
{
"name": "CVE-2026-68118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68118"
},
{
"name": "CVE-2026-74518",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74518"
},
{
"name": "CVE-2026-74503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74503"
},
{
"name": "CVE-2026-68322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68322"
},
{
"name": "CVE-2026-74603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74603"
},
{
"name": "CVE-2026-74587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74587"
},
{
"name": "CVE-2026-74663",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74663"
},
{
"name": "CVE-2026-74472",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74472"
},
{
"name": "CVE-2026-74677",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74677"
},
{
"name": "CVE-2026-68082",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68082"
},
{
"name": "CVE-2026-74494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74494"
},
{
"name": "CVE-2026-74508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74508"
},
{
"name": "CVE-2026-74672",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74672"
},
{
"name": "CVE-2026-74469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74469"
},
{
"name": "CVE-2026-74602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74602"
},
{
"name": "CVE-2026-74483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74483"
},
{
"name": "CVE-2026-74679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74679"
},
{
"name": "CVE-2026-68451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68451"
},
{
"name": "CVE-2026-74717",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74717"
},
{
"name": "CVE-2026-74700",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74700"
},
{
"name": "CVE-2026-74610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74610"
},
{
"name": "CVE-2026-74655",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74655"
},
{
"name": "CVE-2026-74654",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74654"
},
{
"name": "CVE-2026-74658",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74658"
},
{
"name": "CVE-2026-74576",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74576"
},
{
"name": "CVE-2026-74546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74546"
},
{
"name": "CVE-2026-74680",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74680"
},
{
"name": "CVE-2026-74497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74497"
},
{
"name": "CVE-2026-74510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74510"
},
{
"name": "CVE-2026-74455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74455"
},
{
"name": "CVE-2026-74512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74512"
},
{
"name": "CVE-2026-74646",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74646"
},
{
"name": "CVE-2026-74588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74588"
},
{
"name": "CVE-2026-68266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68266"
},
{
"name": "CVE-2026-74556",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74556"
},
{
"name": "CVE-2026-74532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74532"
},
{
"name": "CVE-2026-74595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74595"
},
{
"name": "CVE-2026-68452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68452"
},
{
"name": "CVE-2026-74692",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74692"
},
{
"name": "CVE-2026-74719",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74719"
},
{
"name": "CVE-2026-74585",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74585"
},
{
"name": "CVE-2026-74651",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74651"
},
{
"name": "CVE-2026-74551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74551"
},
{
"name": "CVE-2026-74666",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74666"
},
{
"name": "CVE-2026-74705",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74705"
},
{
"name": "CVE-2026-68431",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68431"
},
{
"name": "CVE-2026-74495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74495"
},
{
"name": "CVE-2026-72111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72111"
},
{
"name": "CVE-2026-68254",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68254"
},
{
"name": "CVE-2026-74720",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74720"
},
{
"name": "CVE-2026-74547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74547"
},
{
"name": "CVE-2026-74579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74579"
},
{
"name": "CVE-2026-74458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74458"
},
{
"name": "CVE-2026-74647",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74647"
},
{
"name": "CVE-2026-74613",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74613"
},
{
"name": "CVE-2026-74525",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74525"
},
{
"name": "CVE-2026-74594",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74594"
},
{
"name": "CVE-2026-74475",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74475"
},
{
"name": "CVE-2026-74659",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74659"
},
{
"name": "CVE-2026-68253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68253"
},
{
"name": "CVE-2026-74621",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74621"
},
{
"name": "CVE-2025-38525",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38525"
},
{
"name": "CVE-2026-74507",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74507"
},
{
"name": "CVE-2026-74606",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74606"
},
{
"name": "CVE-2026-74628",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74628"
},
{
"name": "CVE-2026-74667",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74667"
},
{
"name": "CVE-2026-74601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74601"
},
{
"name": "CVE-2026-74673",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74673"
},
{
"name": "CVE-2026-74722",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74722"
},
{
"name": "CVE-2026-68198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68198"
},
{
"name": "CVE-2026-74635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74635"
},
{
"name": "CVE-2026-74624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74624"
},
{
"name": "CVE-2026-74678",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74678"
},
{
"name": "CVE-2026-74575",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74575"
},
{
"name": "CVE-2026-74480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74480"
},
{
"name": "CVE-2026-74545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74545"
},
{
"name": "CVE-2026-74468",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74468"
},
{
"name": "CVE-2026-74631",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74631"
},
{
"name": "CVE-2026-74634",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74634"
},
{
"name": "CVE-2026-74644",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74644"
},
{
"name": "CVE-2026-74485",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74485"
},
{
"name": "CVE-2026-74564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74564"
},
{
"name": "CVE-2026-74616",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74616"
},
{
"name": "CVE-2026-74712",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74712"
},
{
"name": "CVE-2026-74550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74550"
},
{
"name": "CVE-2026-74509",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74509"
},
{
"name": "CVE-2026-74656",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74656"
},
{
"name": "CVE-2026-74648",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74648"
},
{
"name": "CVE-2026-74650",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74650"
},
{
"name": "CVE-2026-74443",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74443"
},
{
"name": "CVE-2026-74501",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74501"
}
],
"initial_release_date": "2026-08-28T00:00:00",
"last_revision_date": "2026-08-28T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1090",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-28T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian",
"vendor_advisories": [
{
"published_at": "2026-08-25",
"title": "Bulletin de s\u00e9curit\u00e9 Debian msg00377",
"url": "https://lists.debian.org/debian-security-announce/2026/msg00377.html"
}
]
}
CVE-2026-74658 (GCVE-0-2026-74658)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-22 15:32
VLAI
EPSS
VEX
Title
futex: Prevent robust futex exit race some more
Summary
In the Linux kernel, the following vulnerability has been resolved:
futex: Prevent robust futex exit race some more
A robust futex unlock stores 0 over the whole futex value - wiping
FUTEX_WAITERS - and wakes a single waiter. That wakeup is a one-shot
notification: the protocol relies on its recipient to either acquire the
futex (and eventually unlock while aware of the remaining contention) or
re-arm FUTEX_WAITERS before sleeping again. If the woken waiter is killed
before it can do either, the kernel must jump in and wake the next task
down the line.
This is a known complication of the futex protocol with a previous
partial fix in commit ca16d5bee598 ("futex: Prevent robust futex exit
race"). Unfortunately, that fix is insufficient.
If a third task re-acquired the futex through the uncontended fast
path in the meantime, the notification is lost: robust exit processing
sees that it is owned by another task and does nothing, while the new
owner sees no FUTEX_WAITERS when it unlocks and wakes nobody.
The remaining waiters sleep forever behind a free futex:
A owns the futex, B and C sleep in FUTEX_WAIT
uval == A | FUTEX_WAITERS
A robust unlock: store 0, FUTEX_WAKE(1) wakes B
uval == 0
D fast path acquire: cmpxchg(0 -> D)
uval == D, no FUTEX_WAITERS
B killed before acting on the wakeup
B exit walk, pending op: owner D != B -> no action
D unlock: no FUTEX_WAITERS -> no wake
C sleeps forever
This is clearly a shortcoming in the implementation, which fails to keep
the FUTEX_WAITERS bit consistent.
Work around this by augmenting the robust list exit processing to also
perform the extra wakeup if the futex word is owned by another thread but
FUTEX_WAITERS is not set.
This does not fix the problem of a non-contended take over/release and free
sequence, which has been discussed for years and has been addressed by
commit 3ca9595d9fb6 ("futex: Add support for unlocking robust futexes") and
subsequent changes, but failed to take the problem described above into
account.
A more complete solution which is based on the in kernel unlock of
contended robust futexes has been discussed in the context of this change
and should show up in mainline sooner than later.
[ tglx: Amend change log slightly and fixup coding style ]
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ca16d5bee59807bf04deaab0a8eccecd5061528c , < 83b0f71d5a313a765754acab51d2ecc5de76e0b9
(git)
Affected: ca16d5bee59807bf04deaab0a8eccecd5061528c , < a1c2b7b86a946b6b172bce44d74553da2323a36c (git) Affected: ca16d5bee59807bf04deaab0a8eccecd5061528c , < 33bfa85458105d6169ebdb697f692b8bb8025bae (git) Affected: ca16d5bee59807bf04deaab0a8eccecd5061528c , < aa5c571901c6b22b58373693a4bf889ecab11ff5 (git) Affected: ca16d5bee59807bf04deaab0a8eccecd5061528c , < 925628656b73b70930972ccde421de4f758d8650 (git) Affected: ca16d5bee59807bf04deaab0a8eccecd5061528c , < 7b8c53263f8878bdd12c87e147ac6feca5c05211 (git) Affected: ca16d5bee59807bf04deaab0a8eccecd5061528c , < 7cf710e70f9bb8ea75f759ebed09871801315992 (git) Affected: ca16d5bee59807bf04deaab0a8eccecd5061528c , < 6d4514ca9cdf61fec4ec634cf50386f6f7e69748 (git) Affected: 8dd558881e0f4d6942c19bd8f7b1a7c19becb59e (git) Affected: b90aa237f469c3575190a5e6a855b76ad1d2ce94 (git) Affected: 3e24098da750991f75819069c79e090dfd029219 (git) Affected: 2819f4030f43057238992a4adcd950d7c95aff65 (git) Affected: 2c60b44d8ba9d62c2693d2692f118177f212b1a8 (git) Affected: 82ca3ab31b9cf23b86436a85381e4c5757bc6b80 (git) Affected: 3.16.82 , < 3.17 (semver) Affected: 4.9.264 , < 4.10 (semver) Affected: 4.14.158 , < 4.15 (semver) Affected: 4.19.87 , < 4.20 (semver) Affected: 5.3.14 , < 5.4 (semver) Affected: 5.4.1 , < 5.5 (semver) |
|
| Linux | Linux |
Affected:
5.5
Unaffected: 0 , < 5.5 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/futex/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "83b0f71d5a313a765754acab51d2ecc5de76e0b9",
"status": "affected",
"version": "ca16d5bee59807bf04deaab0a8eccecd5061528c",
"versionType": "git"
},
{
"lessThan": "a1c2b7b86a946b6b172bce44d74553da2323a36c",
"status": "affected",
"version": "ca16d5bee59807bf04deaab0a8eccecd5061528c",
"versionType": "git"
},
{
"lessThan": "33bfa85458105d6169ebdb697f692b8bb8025bae",
"status": "affected",
"version": "ca16d5bee59807bf04deaab0a8eccecd5061528c",
"versionType": "git"
},
{
"lessThan": "aa5c571901c6b22b58373693a4bf889ecab11ff5",
"status": "affected",
"version": "ca16d5bee59807bf04deaab0a8eccecd5061528c",
"versionType": "git"
},
{
"lessThan": "925628656b73b70930972ccde421de4f758d8650",
"status": "affected",
"version": "ca16d5bee59807bf04deaab0a8eccecd5061528c",
"versionType": "git"
},
{
"lessThan": "7b8c53263f8878bdd12c87e147ac6feca5c05211",
"status": "affected",
"version": "ca16d5bee59807bf04deaab0a8eccecd5061528c",
"versionType": "git"
},
{
"lessThan": "7cf710e70f9bb8ea75f759ebed09871801315992",
"status": "affected",
"version": "ca16d5bee59807bf04deaab0a8eccecd5061528c",
"versionType": "git"
},
{
"lessThan": "6d4514ca9cdf61fec4ec634cf50386f6f7e69748",
"status": "affected",
"version": "ca16d5bee59807bf04deaab0a8eccecd5061528c",
"versionType": "git"
},
{
"status": "affected",
"version": "8dd558881e0f4d6942c19bd8f7b1a7c19becb59e",
"versionType": "git"
},
{
"status": "affected",
"version": "b90aa237f469c3575190a5e6a855b76ad1d2ce94",
"versionType": "git"
},
{
"status": "affected",
"version": "3e24098da750991f75819069c79e090dfd029219",
"versionType": "git"
},
{
"status": "affected",
"version": "2819f4030f43057238992a4adcd950d7c95aff65",
"versionType": "git"
},
{
"status": "affected",
"version": "2c60b44d8ba9d62c2693d2692f118177f212b1a8",
"versionType": "git"
},
{
"status": "affected",
"version": "82ca3ab31b9cf23b86436a85381e4c5757bc6b80",
"versionType": "git"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.82",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.264",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.158",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.87",
"versionType": "semver"
},
{
"lessThan": "5.4",
"status": "affected",
"version": "5.3.14",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/futex/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.264",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.158",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Prevent robust futex exit race some more\n\nA robust futex unlock stores 0 over the whole futex value - wiping\nFUTEX_WAITERS - and wakes a single waiter. That wakeup is a one-shot\nnotification: the protocol relies on its recipient to either acquire the\nfutex (and eventually unlock while aware of the remaining contention) or\nre-arm FUTEX_WAITERS before sleeping again. If the woken waiter is killed\nbefore it can do either, the kernel must jump in and wake the next task\ndown the line.\n\nThis is a known complication of the futex protocol with a previous\npartial fix in commit ca16d5bee598 (\"futex: Prevent robust futex exit\nrace\"). Unfortunately, that fix is insufficient.\n\nIf a third task re-acquired the futex through the uncontended fast\npath in the meantime, the notification is lost: robust exit processing\nsees that it is owned by another task and does nothing, while the new\nowner sees no FUTEX_WAITERS when it unlocks and wakes nobody.\nThe remaining waiters sleep forever behind a free futex:\n\n A owns the futex, B and C sleep in FUTEX_WAIT\n uval == A | FUTEX_WAITERS\n A robust unlock: store 0, FUTEX_WAKE(1) wakes B\n uval == 0\n D fast path acquire: cmpxchg(0 -\u003e D)\n uval == D, no FUTEX_WAITERS\n B killed before acting on the wakeup\n B exit walk, pending op: owner D != B -\u003e no action\n D unlock: no FUTEX_WAITERS -\u003e no wake\n C sleeps forever\n\nThis is clearly a shortcoming in the implementation, which fails to keep\nthe FUTEX_WAITERS bit consistent.\n\nWork around this by augmenting the robust list exit processing to also\nperform the extra wakeup if the futex word is owned by another thread but\nFUTEX_WAITERS is not set.\n\nThis does not fix the problem of a non-contended take over/release and free\nsequence, which has been discussed for years and has been addressed by\ncommit 3ca9595d9fb6 (\"futex: Add support for unlocking robust futexes\") and\nsubsequent changes, but failed to take the problem described above into\naccount.\n\nA more complete solution which is based on the in kernel unlock of\ncontended robust futexes has been discussed in the context of this change\nand should show up in mainline sooner than later.\n\n[ tglx: Amend change log slightly and fixup coding style ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:32:32.190Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/83b0f71d5a313a765754acab51d2ecc5de76e0b9"
},
{
"url": "https://git.kernel.org/stable/c/a1c2b7b86a946b6b172bce44d74553da2323a36c"
},
{
"url": "https://git.kernel.org/stable/c/33bfa85458105d6169ebdb697f692b8bb8025bae"
},
{
"url": "https://git.kernel.org/stable/c/aa5c571901c6b22b58373693a4bf889ecab11ff5"
},
{
"url": "https://git.kernel.org/stable/c/925628656b73b70930972ccde421de4f758d8650"
},
{
"url": "https://git.kernel.org/stable/c/7b8c53263f8878bdd12c87e147ac6feca5c05211"
},
{
"url": "https://git.kernel.org/stable/c/7cf710e70f9bb8ea75f759ebed09871801315992"
},
{
"url": "https://git.kernel.org/stable/c/6d4514ca9cdf61fec4ec634cf50386f6f7e69748"
}
],
"title": "futex: Prevent robust futex exit race some more",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74658",
"datePublished": "2026-08-22T15:32:32.190Z",
"dateReserved": "2026-08-15T05:44:03.924Z",
"dateUpdated": "2026-08-22T15:32:32.190Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74659 (GCVE-0-2026-74659)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-22 15:32
VLAI
EPSS
VEX
Title
net: bridge: mrp: fix uninitialised bytes on the wire
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mrp: fix uninitialised bytes on the wire
br_mrp_alloc_test_skb() builds MRP test frames on an skb from
dev_alloc_skb(), which does not clear the linear data area. On the MRA
ring-role branch the sub-option TLV header is appended with
sub_tlv = skb_put(skb, sizeof(*sub_tlv));
sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;
so sub_tlv->length is never written, and the two trailing alignment bytes
are appended with a bare skb_put() that does not clear them either. The
neighbouring oui and sub_opt regions are explicitly zeroed, so three
uninitialised bytes are left in every MRA MRP_Test frame that goes out.
Put the sub-option TLV header and the alignment padding in a single
skb_put_zero(), which clears both. The AUTO_MGR sub-TLV carries no
payload, so the zeroed length field is already the value it should have.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f7458934b0791c39a001e4d902fc3bf697b439b5 , < 014c062d23c63ec77ef2cf17a0d9363c7441cc94
(git)
Affected: f7458934b0791c39a001e4d902fc3bf697b439b5 , < 7ebc23ff03668042e0b0e4034bb1518d36198d9e (git) Affected: f7458934b0791c39a001e4d902fc3bf697b439b5 , < 06d58b8d2f053ced82e01efaeb6e7c82891eed58 (git) Affected: f7458934b0791c39a001e4d902fc3bf697b439b5 , < a5e385eeb2d6dbbbdebfa050e67c34734ae12693 (git) Affected: f7458934b0791c39a001e4d902fc3bf697b439b5 , < 5912cf1822fbe53ae275c147868740eb384a5d3e (git) Affected: f7458934b0791c39a001e4d902fc3bf697b439b5 , < e08665218040f8e312abe40f74543186f3c2c941 (git) Affected: f7458934b0791c39a001e4d902fc3bf697b439b5 , < 63488dba65ef91373ef616575b32eb0eb21459f4 (git) |
|
| Linux | Linux |
Affected:
5.14
Unaffected: 0 , < 5.14 (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/br_mrp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "014c062d23c63ec77ef2cf17a0d9363c7441cc94",
"status": "affected",
"version": "f7458934b0791c39a001e4d902fc3bf697b439b5",
"versionType": "git"
},
{
"lessThan": "7ebc23ff03668042e0b0e4034bb1518d36198d9e",
"status": "affected",
"version": "f7458934b0791c39a001e4d902fc3bf697b439b5",
"versionType": "git"
},
{
"lessThan": "06d58b8d2f053ced82e01efaeb6e7c82891eed58",
"status": "affected",
"version": "f7458934b0791c39a001e4d902fc3bf697b439b5",
"versionType": "git"
},
{
"lessThan": "a5e385eeb2d6dbbbdebfa050e67c34734ae12693",
"status": "affected",
"version": "f7458934b0791c39a001e4d902fc3bf697b439b5",
"versionType": "git"
},
{
"lessThan": "5912cf1822fbe53ae275c147868740eb384a5d3e",
"status": "affected",
"version": "f7458934b0791c39a001e4d902fc3bf697b439b5",
"versionType": "git"
},
{
"lessThan": "e08665218040f8e312abe40f74543186f3c2c941",
"status": "affected",
"version": "f7458934b0791c39a001e4d902fc3bf697b439b5",
"versionType": "git"
},
{
"lessThan": "63488dba65ef91373ef616575b32eb0eb21459f4",
"status": "affected",
"version": "f7458934b0791c39a001e4d902fc3bf697b439b5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/br_mrp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mrp: fix uninitialised bytes on the wire\n\nbr_mrp_alloc_test_skb() builds MRP test frames on an skb from\ndev_alloc_skb(), which does not clear the linear data area. On the MRA\nring-role branch the sub-option TLV header is appended with\n\n\tsub_tlv = skb_put(skb, sizeof(*sub_tlv));\n\tsub_tlv-\u003etype = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;\n\nso sub_tlv-\u003elength is never written, and the two trailing alignment bytes\nare appended with a bare skb_put() that does not clear them either. The\nneighbouring oui and sub_opt regions are explicitly zeroed, so three\nuninitialised bytes are left in every MRA MRP_Test frame that goes out.\n\nPut the sub-option TLV header and the alignment padding in a single\nskb_put_zero(), which clears both. The AUTO_MGR sub-TLV carries no\npayload, so the zeroed length field is already the value it should have."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:32:32.926Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/014c062d23c63ec77ef2cf17a0d9363c7441cc94"
},
{
"url": "https://git.kernel.org/stable/c/7ebc23ff03668042e0b0e4034bb1518d36198d9e"
},
{
"url": "https://git.kernel.org/stable/c/06d58b8d2f053ced82e01efaeb6e7c82891eed58"
},
{
"url": "https://git.kernel.org/stable/c/a5e385eeb2d6dbbbdebfa050e67c34734ae12693"
},
{
"url": "https://git.kernel.org/stable/c/5912cf1822fbe53ae275c147868740eb384a5d3e"
},
{
"url": "https://git.kernel.org/stable/c/e08665218040f8e312abe40f74543186f3c2c941"
},
{
"url": "https://git.kernel.org/stable/c/63488dba65ef91373ef616575b32eb0eb21459f4"
}
],
"title": "net: bridge: mrp: fix uninitialised bytes on the wire",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74659",
"datePublished": "2026-08-22T15:32:32.926Z",
"dateReserved": "2026-08-15T05:44:03.924Z",
"dateUpdated": "2026-08-22T15:32:32.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74660 (GCVE-0-2026-74660)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:41
VLAI
EPSS
VEX
Title
netfilter: ebt_nflog: pin the NFLOG backend
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebt_nflog: pin the NFLOG backend
nf_log_unregister() runs after the per-net teardown so its final RCU
grace period also drains readers that obtained the logger from a per-net
binding. However, ebt_nflog passes an explicit ULOG log type to
nf_log_packet() without holding a reference on the selected logger module,
unlike the xt_NFLOG and nft_log frontends.
An ebtables nflog rule can therefore remain callable while nfnetlink_log
is unloaded. The resulting interleaving is:
CPU 0 CPU 1
nfnetlink_log_fini()
unregister_pernet_subsys()
kfree(nfnl_log_pernet(net))
ebt_nflog_tg()
nf_log_packet()
nfulnl_log_packet()
instance_lookup_get_rcu()
The global ULOG logger is still registered at this point, so CPU 1
dereferences the per-net state after CPU 0 has freed it. KASAN reported:
BUG: KASAN: slab-use-after-free in instance_lookup_get_rcu
Read of size 8 at addr ff110001052e6210 by task poc/92
Call Trace:
instance_lookup_get_rcu+0x1ce/0x1f0 [nfnetlink_log]
nfulnl_log_packet+0x248/0x2fb0 [nfnetlink_log]
nf_log_packet+0x204/0x300
ebt_nflog_tg+0x351/0x550
ebt_do_table+0xedf/0x22b0
Allocated by task 90:
__kmalloc_noprof+0x186/0x470
ops_init+0x6d/0x420
register_pernet_operations+0x2f6/0x670
register_pernet_subsys+0x23/0x40
Freed by task 93:
kfree+0x131/0x3c0
ops_undo_list+0x3e3/0x700
unregister_pernet_operations+0x232/0x490
unregister_pernet_subsys+0x1c/0x30
nfnetlink_log_fini+0x34/0x450 [nfnetlink_log]
Acquire the ULOG logger module reference when an ebt_nflog rule is
validated and release it when the rule is destroyed. Request the NFLOG
backend for legacy callers when needed, matching xt_NFLOG. This prevents
module teardown until all ebt_nflog rules have stopped using the logger.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c83fa19603bdaeef17b815713dbbe3230c8a34ee , < 3bcce49d617c593c7606083bfdb464a1761fa68d
(git)
Affected: c83fa19603bdaeef17b815713dbbe3230c8a34ee , < 394d7939c6b2b9e6bea0844c89efb5913168d898 (git) Affected: c83fa19603bdaeef17b815713dbbe3230c8a34ee , < 2cac4294f184c9bc19ff82552c62b80498694c39 (git) Affected: c83fa19603bdaeef17b815713dbbe3230c8a34ee , < 9d8a94b48b393885e7f876c8ef68ed4da5012078 (git) Affected: c83fa19603bdaeef17b815713dbbe3230c8a34ee , < 6809379a860b9fccbb5435bf08343f6d081ac68d (git) Affected: c83fa19603bdaeef17b815713dbbe3230c8a34ee , < 47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb (git) Affected: c83fa19603bdaeef17b815713dbbe3230c8a34ee , < e2ab7e878bdbe80104c879c31fd2d82a476703b8 (git) Affected: c83fa19603bdaeef17b815713dbbe3230c8a34ee , < 30825970339c107bacaf7f61af90fcdb1f597ca1 (git) |
|
| Linux | Linux |
Affected:
4.12
Unaffected: 0 , < 4.12 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/netfilter/ebt_nflog.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3bcce49d617c593c7606083bfdb464a1761fa68d",
"status": "affected",
"version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee",
"versionType": "git"
},
{
"lessThan": "394d7939c6b2b9e6bea0844c89efb5913168d898",
"status": "affected",
"version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee",
"versionType": "git"
},
{
"lessThan": "2cac4294f184c9bc19ff82552c62b80498694c39",
"status": "affected",
"version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee",
"versionType": "git"
},
{
"lessThan": "9d8a94b48b393885e7f876c8ef68ed4da5012078",
"status": "affected",
"version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee",
"versionType": "git"
},
{
"lessThan": "6809379a860b9fccbb5435bf08343f6d081ac68d",
"status": "affected",
"version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee",
"versionType": "git"
},
{
"lessThan": "47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb",
"status": "affected",
"version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee",
"versionType": "git"
},
{
"lessThan": "e2ab7e878bdbe80104c879c31fd2d82a476703b8",
"status": "affected",
"version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee",
"versionType": "git"
},
{
"lessThan": "30825970339c107bacaf7f61af90fcdb1f597ca1",
"status": "affected",
"version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/netfilter/ebt_nflog.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebt_nflog: pin the NFLOG backend\n\nnf_log_unregister() runs after the per-net teardown so its final RCU\ngrace period also drains readers that obtained the logger from a per-net\nbinding. However, ebt_nflog passes an explicit ULOG log type to\nnf_log_packet() without holding a reference on the selected logger module,\nunlike the xt_NFLOG and nft_log frontends.\n\nAn ebtables nflog rule can therefore remain callable while nfnetlink_log\nis unloaded. The resulting interleaving is:\n\n CPU 0 CPU 1\n nfnetlink_log_fini()\n unregister_pernet_subsys()\n kfree(nfnl_log_pernet(net))\n ebt_nflog_tg()\n nf_log_packet()\n nfulnl_log_packet()\n instance_lookup_get_rcu()\n\nThe global ULOG logger is still registered at this point, so CPU 1\ndereferences the per-net state after CPU 0 has freed it. KASAN reported:\n\n BUG: KASAN: slab-use-after-free in instance_lookup_get_rcu\n Read of size 8 at addr ff110001052e6210 by task poc/92\n Call Trace:\n instance_lookup_get_rcu+0x1ce/0x1f0 [nfnetlink_log]\n nfulnl_log_packet+0x248/0x2fb0 [nfnetlink_log]\n nf_log_packet+0x204/0x300\n ebt_nflog_tg+0x351/0x550\n ebt_do_table+0xedf/0x22b0\n Allocated by task 90:\n __kmalloc_noprof+0x186/0x470\n ops_init+0x6d/0x420\n register_pernet_operations+0x2f6/0x670\n register_pernet_subsys+0x23/0x40\n Freed by task 93:\n kfree+0x131/0x3c0\n ops_undo_list+0x3e3/0x700\n unregister_pernet_operations+0x232/0x490\n unregister_pernet_subsys+0x1c/0x30\n nfnetlink_log_fini+0x34/0x450 [nfnetlink_log]\n\nAcquire the ULOG logger module reference when an ebt_nflog rule is\nvalidated and release it when the rule is destroyed. Request the NFLOG\nbackend for legacy callers when needed, matching xt_NFLOG. This prevents\nmodule teardown until all ebt_nflog rules have stopped using the logger."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached through ebtables setsockopt rule installation and nfnetlink_log module teardown (local administrative paths); per kernel CNA guidance, netfilter/ebtables bugs are scored Local even when bridge hook evaluation can be driven by forwarded frames.\nAC:L - The KASAN reproducer uses a deterministic two-thread race between nfnetlink_log_fini() module removal and concurrent bridge traffic through an active ebt_nflog rule; the attacker controls both the unload timing and packet generation without depending on uncontrollable victim state.\nPR:L - Installing an ebt_nflog rule requires CAP_NET_ADMIN in the socket network namespace, obtainable by unprivileged users via user+network namespaces (unshare -Urn); the documented PoC races module teardown concurrently with rule-driven traffic, matching standard CNA treatment for ebtables/netfilter paths.\nUI:N - No victim interaction is required beyond the attacker\u0027s own ebtables configuration, module unload coordination, and bridge traffic generation to hit the active nflog target during the teardown window.\nS:U - The slab use-after-free corrupts host kernel memory within the same security authority; this is not a VM escape, container breakout across an IOMMU boundary, or other cross-scope privilege transition.\nC:H - KASAN confirmed a slab use-after-free read in instance_lookup_get_rcu() against freed nfnl_log_pernet state; UAF on the per-net instance hash table enables attacker-influenced heap reads and disclosure of adjacent kernel memory contents.\nI:H - Use-after-free on the nfnl_log_pernet structure and nfulnl_instance objects provides standard heap grooming primitives; freed slab reuse can redirect subsequent logging operations into attacker-controlled data for arbitrary kernel writes or control-flow hijack.\nA:H - The UAF read on freed per-net logging state can immediately trigger a kernel BUG/oops (as reported by KASAN) and reliably causes denial of service; repeated bridge traffic during module teardown can panic the affected host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:14.285Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3bcce49d617c593c7606083bfdb464a1761fa68d"
},
{
"url": "https://git.kernel.org/stable/c/394d7939c6b2b9e6bea0844c89efb5913168d898"
},
{
"url": "https://git.kernel.org/stable/c/2cac4294f184c9bc19ff82552c62b80498694c39"
},
{
"url": "https://git.kernel.org/stable/c/9d8a94b48b393885e7f876c8ef68ed4da5012078"
},
{
"url": "https://git.kernel.org/stable/c/6809379a860b9fccbb5435bf08343f6d081ac68d"
},
{
"url": "https://git.kernel.org/stable/c/47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb"
},
{
"url": "https://git.kernel.org/stable/c/e2ab7e878bdbe80104c879c31fd2d82a476703b8"
},
{
"url": "https://git.kernel.org/stable/c/30825970339c107bacaf7f61af90fcdb1f597ca1"
}
],
"title": "netfilter: ebt_nflog: pin the NFLOG backend",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74660",
"datePublished": "2026-08-22T15:32:33.677Z",
"dateReserved": "2026-08-15T05:44:03.924Z",
"dateUpdated": "2026-08-25T05:41:14.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74661 (GCVE-0-2026-74661)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:41
VLAI
EPSS
VEX
Title
mac802154: fix netdev use-after-free in beacon worker
Summary
In the Linux kernel, the following vulnerability has been resolved:
mac802154: fix netdev use-after-free in beacon worker
mac802154_beacon_worker() reads local->beacon_req under RCU and derives
the sub-interface from the request, but then drops the RCU read lock and
continues to use both sdata and the embedded wpan_dev.
mac802154_stop_beacons_locked() cancels only pending beacon work, clears
local->beacon_req and frees the request. A beacon worker that is already
running can therefore continue after interface teardown and dereference
the freed netdev private area.
The scan worker already pins the netdev before leaving RCU. Apply the
same lifetime rule to the beacon worker: take a netdev reference while
the request is still protected by RCU, and release it on all paths that
continue after the reference is acquired.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3accf4762734a69ebd03cba989249c78ac7dfc7e , < fe820dcc1d8ff77783a9d2bcc93b98c99ac6d517
(git)
Affected: 3accf4762734a69ebd03cba989249c78ac7dfc7e , < e5fb0e03bc7f45508c182a427357bf6b389a9033 (git) Affected: 3accf4762734a69ebd03cba989249c78ac7dfc7e , < e6cd416a899edc912b428c4ba399bd73f516cb31 (git) Affected: 3accf4762734a69ebd03cba989249c78ac7dfc7e , < 9d067e581597c462c51fee8a30b51bc48a68c4e1 (git) Affected: 3accf4762734a69ebd03cba989249c78ac7dfc7e , < 5f26a690e8efa54315e4922368daf54e0b8f5515 (git) |
|
| Linux | Linux |
Affected:
6.3
Unaffected: 0 , < 6.3 (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac802154/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fe820dcc1d8ff77783a9d2bcc93b98c99ac6d517",
"status": "affected",
"version": "3accf4762734a69ebd03cba989249c78ac7dfc7e",
"versionType": "git"
},
{
"lessThan": "e5fb0e03bc7f45508c182a427357bf6b389a9033",
"status": "affected",
"version": "3accf4762734a69ebd03cba989249c78ac7dfc7e",
"versionType": "git"
},
{
"lessThan": "e6cd416a899edc912b428c4ba399bd73f516cb31",
"status": "affected",
"version": "3accf4762734a69ebd03cba989249c78ac7dfc7e",
"versionType": "git"
},
{
"lessThan": "9d067e581597c462c51fee8a30b51bc48a68c4e1",
"status": "affected",
"version": "3accf4762734a69ebd03cba989249c78ac7dfc7e",
"versionType": "git"
},
{
"lessThan": "5f26a690e8efa54315e4922368daf54e0b8f5515",
"status": "affected",
"version": "3accf4762734a69ebd03cba989249c78ac7dfc7e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac802154/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix netdev use-after-free in beacon worker\n\nmac802154_beacon_worker() reads local-\u003ebeacon_req under RCU and derives\nthe sub-interface from the request, but then drops the RCU read lock and\ncontinues to use both sdata and the embedded wpan_dev.\n\nmac802154_stop_beacons_locked() cancels only pending beacon work, clears\nlocal-\u003ebeacon_req and frees the request. A beacon worker that is already\nrunning can therefore continue after interface teardown and dereference\nthe freed netdev private area.\n\nThe scan worker already pins the netdev before leaving RCU. Apply the\nsame lifetime rule to the beacon worker: take a netdev reference while\nthe request is still protected by RCU, and release it on all paths that\ncontinue after the reference is acquired."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local nl802154 generic-netlink syscalls (NL802154_CMD_SEND_BEACONS/STOP_BEACONS) or closing the wpan netdev; the UAF is in beacon workqueue teardown, not in remote 802.15.4 frame parsing, matching netlink-local kernel guidance.\nAC:L - An attacker with CAP_NET_ADMIN controls both sides of the race by starting beaconing then immediately issuing STOP_BEACONS or DEL_INTERFACE while mac802154_transmit_beacon() keeps the worker running; cancel_delayed_work() does not stop in-flight work, making the UAF reliably triggerable.\nPR:L - Starting/stopping beaconing and deleting wpan interfaces require GENL_ADMIN_PERM (netlink_capable CAP_NET_ADMIN); this is reachable from an unprivileged UID via a user namespace (unshare -Urn), not init-namespace root, consistent with mac802154_hwsim and nl802154 gating.\nUI:N - No victim interaction is required; the attacker triggers the race entirely through their own netlink and interface lifecycle operations without needing another user to click, pair, or mount anything.\nS:U - The use-after-free corrupts kernel heap memory (netdev private ieee802154_sub_if_data) within the same kernel security boundary; it does not cross VM, container, or IOMMU isolation boundaries on its own.\nC:H - Use-after-free of the netdev private area (ieee802154_sub_if_data) after interface teardown allows reading freed slab memory; UAF primitives commonly enable arbitrary kernel memory disclosure via heap grooming.\nI:H - The dangling sdata/wpan_dev pointers enable heap-based memory corruption; UAF of netdev private structures is exploitable for control-flow hijacking and arbitrary kernel write primitives via slab reuse.\nA:H - Concurrent interface teardown while the beacon worker dereferences freed netdev private memory causes kernel oops/panic (KASAN slab-use-after-free), and successful exploitation can crash or hang the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:15.528Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fe820dcc1d8ff77783a9d2bcc93b98c99ac6d517"
},
{
"url": "https://git.kernel.org/stable/c/e5fb0e03bc7f45508c182a427357bf6b389a9033"
},
{
"url": "https://git.kernel.org/stable/c/e6cd416a899edc912b428c4ba399bd73f516cb31"
},
{
"url": "https://git.kernel.org/stable/c/9d067e581597c462c51fee8a30b51bc48a68c4e1"
},
{
"url": "https://git.kernel.org/stable/c/5f26a690e8efa54315e4922368daf54e0b8f5515"
}
],
"title": "mac802154: fix netdev use-after-free in beacon worker",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74661",
"datePublished": "2026-08-22T15:32:34.414Z",
"dateReserved": "2026-08-15T05:44:03.924Z",
"dateUpdated": "2026-08-25T05:41:15.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74663 (GCVE-0-2026-74663)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-27 12:39
VLAI
EPSS
VEX
Title
net/sched: reject overly deep qdisc hierarchies
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: reject overly deep qdisc hierarchies
Deep qdisc hierarchies can lead to excessive recursion in qdisc tree
walkers and exhaust the kernel stack. The existing loop check does not
cover the create-and-graft path, so a hierarchy can still be extended by
creating a new child qdisc below an already deep parent.
Store the hierarchy depth in struct Qdisc and update it when qdiscs are
grafted. Reject new child qdiscs once the parent is already at the maximum
allowed depth.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 08dc49df1527b09d9ea225a7265bbf6c237097bf
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a627d36c2a94e18c8c105ae68008786dfd85592e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9f69bb9fdaa2fe64b68bb62fb84d405784bee540 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8ca8cdb74939581339e1ae370193c0adb5a85336 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2759acf08a3454866660edcd3ef4e64139f254a6 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a4b14a4df29d36458a943f9b521ddd0f940363cc (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e2d658c6427844cee5bc654b436ca68d680b6148 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < dedd34b0f2310e28c5f6d4875cfbf4b7ed821c01 (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.267 , ≤ 5.10.* (semver) Unaffected: 5.15.218 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/sch_generic.h",
"net/sched/sch_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "08dc49df1527b09d9ea225a7265bbf6c237097bf",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a627d36c2a94e18c8c105ae68008786dfd85592e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9f69bb9fdaa2fe64b68bb62fb84d405784bee540",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8ca8cdb74939581339e1ae370193c0adb5a85336",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2759acf08a3454866660edcd3ef4e64139f254a6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a4b14a4df29d36458a943f9b521ddd0f940363cc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e2d658c6427844cee5bc654b436ca68d680b6148",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "dedd34b0f2310e28c5f6d4875cfbf4b7ed821c01",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/sch_generic.h",
"net/sched/sch_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: reject overly deep qdisc hierarchies\n\nDeep qdisc hierarchies can lead to excessive recursion in qdisc tree\nwalkers and exhaust the kernel stack. The existing loop check does not\ncover the create-and-graft path, so a hierarchy can still be extended by\ncreating a new child qdisc below an already deep parent.\n\nStore the hierarchy depth in struct Qdisc and update it when qdiscs are\ngrafted. Reject new child qdiscs once the parent is already at the maximum\nallowed depth."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through RTM_NEWQDISC/tc netlink operations that build or graft qdiscs and invoke recursive qdisc tree walkers such as check_loop(); per kernel CNA guidance, tc/netlink qdisc configuration is Local and is not on any remote packet-receive path.\nAC:L - The create-and-graft path bypasses the existing depth-7 check_loop() guard, so an attacker can deterministically extend a linear classful qdisc chain (e.g., repeated HTB/HFSC grafts) and then trigger check_loop() with a graft/replace to recurse until the kernel stack is exhausted; no race or uncontrollable layout is required.\nPR:L - RTM_NEWQDISC is gated by netlink_net_capable(skb, CAP_NET_ADMIN) in rtnetlink_rcv_msg(), evaluated against the socket netns user_ns; an unprivileged local user routinely obtains CAP_NET_ADMIN via user+network namespaces (unshare -Urn) or containers with NET_ADMIN, not init-namespace root.\nUI:N - Exploitation requires only the attacker\u0027s own tc/netlink qdisc setup and a follow-on graft/replace that walks the deep hierarchy; no victim must open files, mount filesystems, click prompts, or perform any cooperative action.\nS:U - Impact is kernel-stack exhaustion and crash/panic within the same kernel security domain; it does not cross a VM, IOMMU, or sandbox boundary to another security authority such as guest-to-host escape.\nC:H - Unbounded recursion in qdisc tree walkers overflows the kernel task stack and corrupts stack memory before the guard-page fault; under overestimation guidance, such stack corruption is treated as plausibly enabling kernel memory disclosure rather than a pure crash with no data exposure.\nI:H - Recursive stack exhaustion overwrites saved return addresses and adjacent kernel stack frames, providing a plausible path to control-flow hijack or arbitrary kernel modification even though the immediate failure mode is oops/panic, not a bounded integrity change.\nA:H - Excessive recursion in qdisc tree walkers exhausts the kernel stack and causes a kernel oops/panic, denying all system availability on the host until reboot; any kernel stack guard fault or panic from this path scores Availability High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:39:59.404Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/08dc49df1527b09d9ea225a7265bbf6c237097bf"
},
{
"url": "https://git.kernel.org/stable/c/a627d36c2a94e18c8c105ae68008786dfd85592e"
},
{
"url": "https://git.kernel.org/stable/c/9f69bb9fdaa2fe64b68bb62fb84d405784bee540"
},
{
"url": "https://git.kernel.org/stable/c/8ca8cdb74939581339e1ae370193c0adb5a85336"
},
{
"url": "https://git.kernel.org/stable/c/2759acf08a3454866660edcd3ef4e64139f254a6"
},
{
"url": "https://git.kernel.org/stable/c/a4b14a4df29d36458a943f9b521ddd0f940363cc"
},
{
"url": "https://git.kernel.org/stable/c/e2d658c6427844cee5bc654b436ca68d680b6148"
},
{
"url": "https://git.kernel.org/stable/c/dedd34b0f2310e28c5f6d4875cfbf4b7ed821c01"
}
],
"title": "net/sched: reject overly deep qdisc hierarchies",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74663",
"datePublished": "2026-08-22T15:32:35.871Z",
"dateReserved": "2026-08-15T05:44:03.924Z",
"dateUpdated": "2026-08-27T12:39:59.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74664 (GCVE-0-2026-74664)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-22 15:32
VLAI
EPSS
VEX
Title
net: openvswitch: reallocate update replies for mismatched IDs
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: reallocate update replies for mismatched IDs
ovs_flow_cmd_new() preallocates the optional reply skb before it takes
ovs_mutex and before it knows which existing flow will be updated.
That is normally fine because the skb is sized from the request flow
identifier. That identifier also becomes the inserted flow's identifier.
For updates, however, a request with a UFID may miss the UFID lookup and
then fall back to the flow key lookup. That lookup can legitimately find
an existing key-identified flow. UFIDs are optional and the flow key is
the primary identifier.
For echoed replies, ovs_flow_cmd_fill_info() writes the matched flow's
identifier, not the request identifier used for the preallocation. A short
request UFID can therefore leave too little room for the key identifier.
The fill can then fail with -EMSGSIZE and hit the BUG_ON(error < 0) in the
update path.
Once the update target has been resolved, reallocate the reply skb if the
matched flow needs a larger reply than the request identifier allowed. Do
this before replacing the actions so the request can still fail cleanly if
the rare extra allocation fails.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
74ed7ab9264c54471c7f057409d352052820d750 , < bd8ca84d48cd9a4f6fc63df26512c55e1d339927
(git)
Affected: 74ed7ab9264c54471c7f057409d352052820d750 , < 00f987f066e802793a37dd2167459e67cf2cf2ec (git) Affected: 74ed7ab9264c54471c7f057409d352052820d750 , < 696a0b9435fce9cf4f1e9ba7f6afa6bee96c97fc (git) Affected: 74ed7ab9264c54471c7f057409d352052820d750 , < 87d0c0040b5d4b61de51ae39132c4c46709f2f77 (git) Affected: 74ed7ab9264c54471c7f057409d352052820d750 , < 69f40ccf85074981340847d650a9cbf9adabfbbe (git) Affected: 74ed7ab9264c54471c7f057409d352052820d750 , < 23716dd9d8d46a5908536b73dc085e62f2b5c237 (git) Affected: 74ed7ab9264c54471c7f057409d352052820d750 , < 20751193d83be2e9735d4faee71375691c09cd13 (git) Affected: 74ed7ab9264c54471c7f057409d352052820d750 , < 5d1c224dd914579524a183a514c12b95095d12ce (git) |
|
| Linux | Linux |
Affected:
4.0
Unaffected: 0 , < 4.0 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/datapath.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bd8ca84d48cd9a4f6fc63df26512c55e1d339927",
"status": "affected",
"version": "74ed7ab9264c54471c7f057409d352052820d750",
"versionType": "git"
},
{
"lessThan": "00f987f066e802793a37dd2167459e67cf2cf2ec",
"status": "affected",
"version": "74ed7ab9264c54471c7f057409d352052820d750",
"versionType": "git"
},
{
"lessThan": "696a0b9435fce9cf4f1e9ba7f6afa6bee96c97fc",
"status": "affected",
"version": "74ed7ab9264c54471c7f057409d352052820d750",
"versionType": "git"
},
{
"lessThan": "87d0c0040b5d4b61de51ae39132c4c46709f2f77",
"status": "affected",
"version": "74ed7ab9264c54471c7f057409d352052820d750",
"versionType": "git"
},
{
"lessThan": "69f40ccf85074981340847d650a9cbf9adabfbbe",
"status": "affected",
"version": "74ed7ab9264c54471c7f057409d352052820d750",
"versionType": "git"
},
{
"lessThan": "23716dd9d8d46a5908536b73dc085e62f2b5c237",
"status": "affected",
"version": "74ed7ab9264c54471c7f057409d352052820d750",
"versionType": "git"
},
{
"lessThan": "20751193d83be2e9735d4faee71375691c09cd13",
"status": "affected",
"version": "74ed7ab9264c54471c7f057409d352052820d750",
"versionType": "git"
},
{
"lessThan": "5d1c224dd914579524a183a514c12b95095d12ce",
"status": "affected",
"version": "74ed7ab9264c54471c7f057409d352052820d750",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/datapath.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: reallocate update replies for mismatched IDs\n\novs_flow_cmd_new() preallocates the optional reply skb before it takes\novs_mutex and before it knows which existing flow will be updated.\n\nThat is normally fine because the skb is sized from the request flow\nidentifier. That identifier also becomes the inserted flow\u0027s identifier.\nFor updates, however, a request with a UFID may miss the UFID lookup and\nthen fall back to the flow key lookup. That lookup can legitimately find\nan existing key-identified flow. UFIDs are optional and the flow key is\nthe primary identifier.\n\nFor echoed replies, ovs_flow_cmd_fill_info() writes the matched flow\u0027s\nidentifier, not the request identifier used for the preallocation. A short\nrequest UFID can therefore leave too little room for the key identifier.\nThe fill can then fail with -EMSGSIZE and hit the BUG_ON(error \u003c 0) in the\nupdate path.\n\nOnce the update target has been resolved, reallocate the reply skb if the\nmatched flow needs a larger reply than the request identifier allowed. Do\nthis before replacing the actions so the request can still fail cleanly if\nthe rare extra allocation fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:32:36.616Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bd8ca84d48cd9a4f6fc63df26512c55e1d339927"
},
{
"url": "https://git.kernel.org/stable/c/00f987f066e802793a37dd2167459e67cf2cf2ec"
},
{
"url": "https://git.kernel.org/stable/c/696a0b9435fce9cf4f1e9ba7f6afa6bee96c97fc"
},
{
"url": "https://git.kernel.org/stable/c/87d0c0040b5d4b61de51ae39132c4c46709f2f77"
},
{
"url": "https://git.kernel.org/stable/c/69f40ccf85074981340847d650a9cbf9adabfbbe"
},
{
"url": "https://git.kernel.org/stable/c/23716dd9d8d46a5908536b73dc085e62f2b5c237"
},
{
"url": "https://git.kernel.org/stable/c/20751193d83be2e9735d4faee71375691c09cd13"
},
{
"url": "https://git.kernel.org/stable/c/5d1c224dd914579524a183a514c12b95095d12ce"
}
],
"title": "net: openvswitch: reallocate update replies for mismatched IDs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74664",
"datePublished": "2026-08-22T15:32:36.616Z",
"dateReserved": "2026-08-15T05:44:03.924Z",
"dateUpdated": "2026-08-22T15:32:36.616Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74665 (GCVE-0-2026-74665)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:41
VLAI
EPSS
VEX
Title
net: fix skb length accounting after generic XDP frag adjustment
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: fix skb length accounting after generic XDP frag adjustment
Generic XDP exposes non-linear skb fragments through an xdp_buff. If an
XDP program adjusts the fragment area, bpf_prog_run_generic_xdp() copies
xdp_frags_size back to skb->data_len but leaves skb->len containing the
old fragment contribution.
After a fragment shrink, this makes skb_headlen() larger than the actual
linear area. In the reproduced UDP receive path, __skb_datagram_iter()
copied 1024 bytes past the actual linear tail to userspace, starting at
struct skb_shared_info. The copied bytes included the affected skb's
nr_frags, xdp_frags_size and a kernel pointer from
skb_shinfo(skb)->frags[0]. Real packet data was displaced by the same
amount and truncated at the end.
Subtract the old data_len before replacing it and add the new data_len
afterwards, keeping skb->len and skb->data_len synchronized.
A 60000-byte UDP datagram on a veth pair with MTU 64000 was shortened by
1024 bytes from its fragment area. Before the fix, all 10 runs produced
corrupted payloads. After the fix, all 10 runs matched the expected
payload exactly.
Severity
9.1 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e6d5dbdd20aa6a86974af51deb9414cd2e7794cb , < 72468efcc089782fa047afddd10856b11a14ef5b
(git)
Affected: e6d5dbdd20aa6a86974af51deb9414cd2e7794cb , < 5f30f9c302cea1f2ebf97abe574c1826544223d7 (git) Affected: e6d5dbdd20aa6a86974af51deb9414cd2e7794cb , < ea1ccd6d1c6370868e3b032a3fc575b9c397f2e1 (git) Affected: e6d5dbdd20aa6a86974af51deb9414cd2e7794cb , < 33f2b2eb33d666ecac68031e0f31424fb70528db (git) |
|
| Linux | Linux |
Affected:
6.9
Unaffected: 0 , < 6.9 (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "72468efcc089782fa047afddd10856b11a14ef5b",
"status": "affected",
"version": "e6d5dbdd20aa6a86974af51deb9414cd2e7794cb",
"versionType": "git"
},
{
"lessThan": "5f30f9c302cea1f2ebf97abe574c1826544223d7",
"status": "affected",
"version": "e6d5dbdd20aa6a86974af51deb9414cd2e7794cb",
"versionType": "git"
},
{
"lessThan": "ea1ccd6d1c6370868e3b032a3fc575b9c397f2e1",
"status": "affected",
"version": "e6d5dbdd20aa6a86974af51deb9414cd2e7794cb",
"versionType": "git"
},
{
"lessThan": "33f2b2eb33d666ecac68031e0f31424fb70528db",
"status": "affected",
"version": "e6d5dbdd20aa6a86974af51deb9414cd2e7794cb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix skb length accounting after generic XDP frag adjustment\n\nGeneric XDP exposes non-linear skb fragments through an xdp_buff. If an\nXDP program adjusts the fragment area, bpf_prog_run_generic_xdp() copies\nxdp_frags_size back to skb-\u003edata_len but leaves skb-\u003elen containing the\nold fragment contribution.\n\nAfter a fragment shrink, this makes skb_headlen() larger than the actual\nlinear area. In the reproduced UDP receive path, __skb_datagram_iter()\ncopied 1024 bytes past the actual linear tail to userspace, starting at\nstruct skb_shared_info. The copied bytes included the affected skb\u0027s\nnr_frags, xdp_frags_size and a kernel pointer from\nskb_shinfo(skb)-\u003efrags[0]. Real packet data was displaced by the same\namount and truncated at the end.\n\nSubtract the old data_len before replacing it and add the new data_len\nafterwards, keeping skb-\u003elen and skb-\u003edata_len synchronized.\n\nA 60000-byte UDP datagram on a veth pair with MTU 64000 was shortened by\n1024 bytes from its fragment area. Before the fix, all 10 runs produced\ncorrupted payloads. After the fix, all 10 runs matched the expected\npayload exactly."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The flaw is hit when remotely delivered packets traverse __netif_receive_skb_core(), netif_receive_generic_xdp(), and bpf_prog_run_generic_xdp() on any netdev with generic XDP (SKB mode) attached, matching the reproduced UDP receive path on a veth pair.\nAC:L - An attacker can reliably send large fragmented datagrams (reproducer used a 60000-byte UDP payload) to create a nonlinear skb and drive bpf_xdp_adjust_tail() fragment shrink before XDP_PASS, with no race or conditions outside attacker packet control.\nPR:N - Exploitation only requires generic XDP using bpf_xdp_adjust_tail to already be attached on a reachable interface; the remote packet sender needs no local account, capabilities, or authentication to trigger the bad skb length accounting.\nUI:N - No victim interaction is needed beyond normal always-on packet reception and socket delivery; corrupted/leaked data is produced automatically when a userspace process reads the affected datagram.\nS:U - Impact stays within the same kernel/host security authority by leaking kernel memory into a local userspace receive buffer and does not by itself cross VM, container, or IOMMU isolation boundaries.\nC:H - Inflated skb_headlen() makes __skb_datagram_iter() copy up to 1024 bytes past the real linear tail into userspace, exposing skb_shared_info metadata and a kernel pointer from skb_shinfo(skb)-\u003efrags[0].\nI:H - The same length mismatch displaces and truncates real packet bytes in the delivered datagram, corrupting application-visible data beyond intended bounds and compounding misuse of leaked kernel metadata.\nA:N - The demonstrated failure is out-of-bounds kernel-to-userspace copy and datagram corruption without a reported kernel panic, oops, hang, or other availability loss in the fix commit or reproduction."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:19.196Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/72468efcc089782fa047afddd10856b11a14ef5b"
},
{
"url": "https://git.kernel.org/stable/c/5f30f9c302cea1f2ebf97abe574c1826544223d7"
},
{
"url": "https://git.kernel.org/stable/c/ea1ccd6d1c6370868e3b032a3fc575b9c397f2e1"
},
{
"url": "https://git.kernel.org/stable/c/33f2b2eb33d666ecac68031e0f31424fb70528db"
}
],
"title": "net: fix skb length accounting after generic XDP frag adjustment",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74665",
"datePublished": "2026-08-22T15:32:37.346Z",
"dateReserved": "2026-08-15T05:44:03.924Z",
"dateUpdated": "2026-08-25T05:41:19.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74666 (GCVE-0-2026-74666)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-27 12:40
VLAI
EPSS
VEX
Title
packet: synchronize pressure clearing with ring reconfiguration
Summary
In the Linux kernel, the following vulnerability has been resolved:
packet: synchronize pressure clearing with ring reconfiguration
packet_set_ring() updates the RX ring state under sk_receive_queue.lock,
but used to publish the tpacket receive mode through po->prot_hook.func
after releasing that lock. packet_poll() and packet_recvmsg() can then
run the pressure clearing path after the ring has been cleared while
still seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference
stale or NULL ring storage.
Move the existing receive hook assignment into the same
sk_receive_queue.lock section as the ring state update. Keep the
assignment otherwise unchanged, including on TX ring reconfiguration, to
avoid adding behavior changes that are not required for the fix.
Serialize packet_recvmsg() pressure clearing with the same queue lock
only after PACKET_SOCK_PRESSURE has been observed. If the flag is clear
and the socket has moved away from tpacket_rcv, packet_set_ring() has
already detached the socket and waited for synchronize_net(), so no new
packet input can set the flag again.
packet_poll() already holds sk_receive_queue.lock, so it uses the new
unlocked helper directly.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2ccdbaa6d55b0656244ba57c4b56765a0af76c0a , < bf3c8e86bc8ad111be3f3136125e255344bcb3da
(git)
Affected: 2ccdbaa6d55b0656244ba57c4b56765a0af76c0a , < 8cfb2e71926a682f36c4240067d424074dd8f70f (git) Affected: 2ccdbaa6d55b0656244ba57c4b56765a0af76c0a , < f015c9de92b731814059a343b765c60c0196225c (git) Affected: 2ccdbaa6d55b0656244ba57c4b56765a0af76c0a , < cf8189b82bb93f219ab740e0346c919ad65ada62 (git) Affected: 2ccdbaa6d55b0656244ba57c4b56765a0af76c0a , < ad740b4990347521f0db260d381f9f74e7b340ba (git) Affected: 2ccdbaa6d55b0656244ba57c4b56765a0af76c0a , < 2c7b5eb87b2b288cdbde825f21d2b83b2f5da747 (git) Affected: 2ccdbaa6d55b0656244ba57c4b56765a0af76c0a , < a08196c3cc105947746ec21309edfbb60275fcdb (git) Affected: 2ccdbaa6d55b0656244ba57c4b56765a0af76c0a , < 1a35da325cac4d5bcad76a2aa943408a6f1d9000 (git) |
|
| Linux | Linux |
Affected:
4.2
Unaffected: 0 , < 4.2 (semver) Unaffected: 5.10.267 , ≤ 5.10.* (semver) Unaffected: 5.15.218 , ≤ 5.15.* (semver) Unaffected: 6.1.185 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bf3c8e86bc8ad111be3f3136125e255344bcb3da",
"status": "affected",
"version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a",
"versionType": "git"
},
{
"lessThan": "8cfb2e71926a682f36c4240067d424074dd8f70f",
"status": "affected",
"version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a",
"versionType": "git"
},
{
"lessThan": "f015c9de92b731814059a343b765c60c0196225c",
"status": "affected",
"version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a",
"versionType": "git"
},
{
"lessThan": "cf8189b82bb93f219ab740e0346c919ad65ada62",
"status": "affected",
"version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a",
"versionType": "git"
},
{
"lessThan": "ad740b4990347521f0db260d381f9f74e7b340ba",
"status": "affected",
"version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a",
"versionType": "git"
},
{
"lessThan": "2c7b5eb87b2b288cdbde825f21d2b83b2f5da747",
"status": "affected",
"version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a",
"versionType": "git"
},
{
"lessThan": "a08196c3cc105947746ec21309edfbb60275fcdb",
"status": "affected",
"version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a",
"versionType": "git"
},
{
"lessThan": "1a35da325cac4d5bcad76a2aa943408a6f1d9000",
"status": "affected",
"version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: synchronize pressure clearing with ring reconfiguration\n\npacket_set_ring() updates the RX ring state under sk_receive_queue.lock,\nbut used to publish the tpacket receive mode through po-\u003eprot_hook.func\nafter releasing that lock. packet_poll() and packet_recvmsg() can then\nrun the pressure clearing path after the ring has been cleared while\nstill seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference\nstale or NULL ring storage.\n\nMove the existing receive hook assignment into the same\nsk_receive_queue.lock section as the ring state update. Keep the\nassignment otherwise unchanged, including on TX ring reconfiguration, to\navoid adding behavior changes that are not required for the fix.\n\nSerialize packet_recvmsg() pressure clearing with the same queue lock\nonly after PACKET_SOCK_PRESSURE has been observed. If the flag is clear\nand the socket has moved away from tpacket_rcv, packet_set_ring() has\nalready detached the socket and waited for synchronize_net(), so no new\npacket input can set the flag again.\n\npacket_poll() already holds sk_receive_queue.lock, so it uses the new\nunlocked helper directly."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is hit only from local AF_PACKET syscalls\u2014setsockopt(PACKET_RX_RING) racing poll(2)/recvmsg(2) pressure clearing in packet_poll()/packet_recvmsg()\u2014not from remote packet receive paths like ksmbd, nfsd, or the TCP/IP stack.\nAC:L - The attacker controls both race sides: one thread polls/recvmsg while PACKET_SOCK_PRESSURE is set, another tears down the RX ring via PACKET_RX_RING; packet_set_ring()\u0027s synchronize_net() window makes the stale tpacket_rcv vs NULL/freed pg_vec mismatch reliably winnable.\nPR:L - packet_create() requires ns_capable(net-\u003euser_ns, CAP_NET_RAW); unprivileged users obtain CAP_NET_RAW via user+network namespaces (unshare -Urn) or container defaults (Docker NET_RAW), without init-namespace root.\nUI:N - No victim action is required; the attacker creates the AF_PACKET socket, configures the mmap RX ring, fills it to set PACKET_SOCK_PRESSURE, and races ring teardown against its own poll/recvmsg calls.\nS:U - Stale/NULL ring dereferences corrupt kernel heap state on the same host; this is standard kernel memory corruption within one security authority, not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - __packet_rcv_has_room() follows tpacket_rcv and dereferences rb-\u003epg_vec or prb_bdqc block pointers after packet_set_ring() cleared/freed the ring, yielding NULL-dereference or use-after-free reads of ring metadata and mmap-backed pages.\nI:H - Freed ring storage and stale prb_bdqc/pkbdq pointers remain attacker-influenced through mmap and concurrent ring operations, providing a controllable kernel heap use-after-free write primitive typical of AF_PACKET ring reconfiguration races.\nA:H - NULL pg_vec indexing in packet_lookup_frame() or stale block access in prb_lookup_block() from the pressure-clearing path causes an immediate kernel oops/panic, giving any qualifying local attacker repeatable host-wide denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:40:00.544Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bf3c8e86bc8ad111be3f3136125e255344bcb3da"
},
{
"url": "https://git.kernel.org/stable/c/8cfb2e71926a682f36c4240067d424074dd8f70f"
},
{
"url": "https://git.kernel.org/stable/c/f015c9de92b731814059a343b765c60c0196225c"
},
{
"url": "https://git.kernel.org/stable/c/cf8189b82bb93f219ab740e0346c919ad65ada62"
},
{
"url": "https://git.kernel.org/stable/c/ad740b4990347521f0db260d381f9f74e7b340ba"
},
{
"url": "https://git.kernel.org/stable/c/2c7b5eb87b2b288cdbde825f21d2b83b2f5da747"
},
{
"url": "https://git.kernel.org/stable/c/a08196c3cc105947746ec21309edfbb60275fcdb"
},
{
"url": "https://git.kernel.org/stable/c/1a35da325cac4d5bcad76a2aa943408a6f1d9000"
}
],
"title": "packet: synchronize pressure clearing with ring reconfiguration",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74666",
"datePublished": "2026-08-22T15:32:38.098Z",
"dateReserved": "2026-08-15T05:44:03.924Z",
"dateUpdated": "2026-08-27T12:40:00.544Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74667 (GCVE-0-2026-74667)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:41
VLAI
EPSS
VEX
Title
net/packet: reset the MAC header on the packet-socket transmit path
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/packet: reset the MAC header on the packet-socket transmit path
packet_parse_headers() resets the MAC header only for a SOCK_RAW frame
whose socket did not bind a protocol. A protocol-bound SOCK_RAW socket,
any SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave
skb->mac_header unset here.
For frames sent via __dev_queue_xmit() this is harmless: it resets the
MAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS
path uses dev_direct_xmit(), which does not, so the frame reaches
ndo_start_xmit() with the MAC header unset. A driver that reads
eth_hdr(skb) on transmit then dereferences skb->head + (u16)~0, an
out-of-bounds access ~64 KiB past the head -- the same class fixed for
one consumer in commit f5089008f90c ("macsec: do not read an unset MAC
header in macsec_encrypt()").
packet_parse_headers() runs only on the transmit path, where skb->data
points at the start of the L2 header for every packet-socket type
regardless of its length: SOCK_RAW and SOCK_PACKET carry a user-supplied
header and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC
header unconditionally, mirroring __dev_queue_xmit(), so the frame is
anchored on the bypass path too.
Found by 0sec (https://0sec.ai) using automated source analysis;
verified against source and matched to the macsec KASAN report in
f5089008f90c. Compile-tested.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
75c65772c3d18447d62d3aca5f91b06c16cc25e4 , < 1e43a1d66615f411d427f9df1f46dd049d9e3681
(git)
Affected: 75c65772c3d18447d62d3aca5f91b06c16cc25e4 , < 4057853a91fb796c4f47c7d1baf1aa085394148e (git) Affected: 75c65772c3d18447d62d3aca5f91b06c16cc25e4 , < 2610ed4e86a4590234a9d70518c469751c5af231 (git) Affected: 75c65772c3d18447d62d3aca5f91b06c16cc25e4 , < b47ba8fe6e1d2df8c92048de5afafd059447dc30 (git) Affected: 75c65772c3d18447d62d3aca5f91b06c16cc25e4 , < 284f3e7a3f1a743fdf89e304fd1f19d5ffcff46d (git) Affected: 75c65772c3d18447d62d3aca5f91b06c16cc25e4 , < 971aa7d99242bbf09513e27b7a243f0b29ff23ae (git) Affected: 75c65772c3d18447d62d3aca5f91b06c16cc25e4 , < fdd4d7d52358a58e351dd9d82530c04eba8ccd7a (git) Affected: 75c65772c3d18447d62d3aca5f91b06c16cc25e4 , < c2707480cfbf19c7619acc9c089d17f20869821f (git) |
|
| Linux | Linux |
Affected:
5.1
Unaffected: 0 , < 5.1 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1e43a1d66615f411d427f9df1f46dd049d9e3681",
"status": "affected",
"version": "75c65772c3d18447d62d3aca5f91b06c16cc25e4",
"versionType": "git"
},
{
"lessThan": "4057853a91fb796c4f47c7d1baf1aa085394148e",
"status": "affected",
"version": "75c65772c3d18447d62d3aca5f91b06c16cc25e4",
"versionType": "git"
},
{
"lessThan": "2610ed4e86a4590234a9d70518c469751c5af231",
"status": "affected",
"version": "75c65772c3d18447d62d3aca5f91b06c16cc25e4",
"versionType": "git"
},
{
"lessThan": "b47ba8fe6e1d2df8c92048de5afafd059447dc30",
"status": "affected",
"version": "75c65772c3d18447d62d3aca5f91b06c16cc25e4",
"versionType": "git"
},
{
"lessThan": "284f3e7a3f1a743fdf89e304fd1f19d5ffcff46d",
"status": "affected",
"version": "75c65772c3d18447d62d3aca5f91b06c16cc25e4",
"versionType": "git"
},
{
"lessThan": "971aa7d99242bbf09513e27b7a243f0b29ff23ae",
"status": "affected",
"version": "75c65772c3d18447d62d3aca5f91b06c16cc25e4",
"versionType": "git"
},
{
"lessThan": "fdd4d7d52358a58e351dd9d82530c04eba8ccd7a",
"status": "affected",
"version": "75c65772c3d18447d62d3aca5f91b06c16cc25e4",
"versionType": "git"
},
{
"lessThan": "c2707480cfbf19c7619acc9c089d17f20869821f",
"status": "affected",
"version": "75c65772c3d18447d62d3aca5f91b06c16cc25e4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: reset the MAC header on the packet-socket transmit path\n\npacket_parse_headers() resets the MAC header only for a SOCK_RAW frame\nwhose socket did not bind a protocol. A protocol-bound SOCK_RAW socket,\nany SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave\nskb-\u003emac_header unset here.\n\nFor frames sent via __dev_queue_xmit() this is harmless: it resets the\nMAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS\npath uses dev_direct_xmit(), which does not, so the frame reaches\nndo_start_xmit() with the MAC header unset. A driver that reads\neth_hdr(skb) on transmit then dereferences skb-\u003ehead + (u16)~0, an\nout-of-bounds access ~64 KiB past the head -- the same class fixed for\none consumer in commit f5089008f90c (\"macsec: do not read an unset MAC\nheader in macsec_encrypt()\").\n\npacket_parse_headers() runs only on the transmit path, where skb-\u003edata\npoints at the start of the L2 header for every packet-socket type\nregardless of its length: SOCK_RAW and SOCK_PACKET carry a user-supplied\nheader and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC\nheader unconditionally, mirroring __dev_queue_xmit(), so the frame is\nanchored on the bypass path too.\n\nFound by 0sec (https://0sec.ai) using automated source analysis;\nverified against source and matched to the macsec KASAN report in\nf5089008f90c. Compile-tested."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only via local AF_PACKET transmit syscalls (sendmsg on SOCK_DGRAM/bound SOCK_RAW with PACKET_QDISC_BYPASS); remote network input cannot trigger packet_parse_headers() on this TX path.\nAC:L - The attacker controls socket type, enables PACKET_QDISC_BYPASS via setsockopt, selects a vulnerable netdev (macsec/macvlan/tap), and sends frames to reliably hit dev_direct_xmit() without races or external victim state.\nPR:L - packet_create() requires CAP_NET_RAW, which unprivileged users commonly obtain inside user+network namespaces (unshare -Urn) per kernel capability rules, not solely real root in the init namespace.\nUI:N - Exploitation requires only the attacker opening a packet socket, enabling bypass, and transmitting; no victim user action such as opening files or mounting filesystems is needed.\nS:U - Impact is kernel heap/slab disclosure and transmit-time corruption within the same kernel security authority; it is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Unset mac_header makes eth_hdr(skb) a large out-of-bounds kernel memory read (~64 KiB past skb-\u003ehead); macsec KASAN confirmed slab data leakage and bytes can be emitted on the wire in the frame.\nI:H - Affected TX drivers consume the bogus eth_hdr() pointer to modify skbs (e.g., macsec memmove of OOB MAC bytes into the frame, vxlan header rewrites), giving attacker-influenced corruption beyond a pure read.\nA:H - The invalid mac_header dereference can fault or trigger KASAN/driver failures during ndo_start_xmit(), causing kernel oops/panic or repeated transmit failure on the bypass path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:21.641Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1e43a1d66615f411d427f9df1f46dd049d9e3681"
},
{
"url": "https://git.kernel.org/stable/c/4057853a91fb796c4f47c7d1baf1aa085394148e"
},
{
"url": "https://git.kernel.org/stable/c/2610ed4e86a4590234a9d70518c469751c5af231"
},
{
"url": "https://git.kernel.org/stable/c/b47ba8fe6e1d2df8c92048de5afafd059447dc30"
},
{
"url": "https://git.kernel.org/stable/c/284f3e7a3f1a743fdf89e304fd1f19d5ffcff46d"
},
{
"url": "https://git.kernel.org/stable/c/971aa7d99242bbf09513e27b7a243f0b29ff23ae"
},
{
"url": "https://git.kernel.org/stable/c/fdd4d7d52358a58e351dd9d82530c04eba8ccd7a"
},
{
"url": "https://git.kernel.org/stable/c/c2707480cfbf19c7619acc9c089d17f20869821f"
}
],
"title": "net/packet: reset the MAC header on the packet-socket transmit path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74667",
"datePublished": "2026-08-22T15:32:38.862Z",
"dateReserved": "2026-08-15T05:44:03.924Z",
"dateUpdated": "2026-08-25T05:41:21.641Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74668 (GCVE-0-2026-74668)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-27 12:40
VLAI
EPSS
VEX
Title
packet: use consistent hard_header_len in TX_RING send path
Summary
In the Linux kernel, the following vulnerability has been resolved:
packet: use consistent hard_header_len in TX_RING send path
tpacket_snd() reads dev->hard_header_len independently for skb
allocation and header construction in tpacket_fill_skb(). Concurrent
netdevice reconfiguration can therefore make the reserved headroom
smaller than the amount later pushed, or make copylen - hard_header_len
negative.
Snapshot hard_header_len once before processing ring frames and use it
for the frame limit, headroom allocation, copy length, and skb
construction. Pass the snapshot to tpacket_fill_skb().
The separate SOCK_DGRAM consistency problem between hard_header_len and
header_ops->create is not addressed here.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 , < 9c7e8ff48c377bef18c3d178748aea0575b69ede
(git)
Affected: 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 , < 2a73b2c37ee3060a880b53cd24783d93fc7be5f8 (git) Affected: 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 , < e79f59a8527a49078cfaf8fe8fb5fcefc20c76d2 (git) Affected: 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 , < d85d2fd54e901637c81d847811e03c662aee13cd (git) Affected: 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 , < 016763e829cac37b3234eace86fd0a4c560de4a7 (git) Affected: 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 , < 27e068d1b35dbec10a3cf268887c94407be4badc (git) Affected: 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 , < d48ea5c9c4c34dc0df621f0e39ed3a16b644621a (git) Affected: 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 , < 21b5953e7494c16a42e6cd8cf110e18d13ae4a6b (git) |
|
| Linux | Linux |
Affected:
2.6.31
Unaffected: 0 , < 2.6.31 (semver) Unaffected: 5.10.267 , ≤ 5.10.* (semver) Unaffected: 5.15.218 , ≤ 5.15.* (semver) Unaffected: 6.1.185 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9c7e8ff48c377bef18c3d178748aea0575b69ede",
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"versionType": "git"
},
{
"lessThan": "2a73b2c37ee3060a880b53cd24783d93fc7be5f8",
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"versionType": "git"
},
{
"lessThan": "e79f59a8527a49078cfaf8fe8fb5fcefc20c76d2",
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"versionType": "git"
},
{
"lessThan": "d85d2fd54e901637c81d847811e03c662aee13cd",
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"versionType": "git"
},
{
"lessThan": "016763e829cac37b3234eace86fd0a4c560de4a7",
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"versionType": "git"
},
{
"lessThan": "27e068d1b35dbec10a3cf268887c94407be4badc",
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"versionType": "git"
},
{
"lessThan": "d48ea5c9c4c34dc0df621f0e39ed3a16b644621a",
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"versionType": "git"
},
{
"lessThan": "21b5953e7494c16a42e6cd8cf110e18d13ae4a6b",
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in TX_RING send path\n\ntpacket_snd() reads dev-\u003ehard_header_len independently for skb\nallocation and header construction in tpacket_fill_skb(). Concurrent\nnetdevice reconfiguration can therefore make the reserved headroom\nsmaller than the amount later pushed, or make copylen - hard_header_len\nnegative.\n\nSnapshot hard_header_len once before processing ring frames and use it\nfor the frame limit, headroom allocation, copy length, and skb\nconstruction. Pass the snapshot to tpacket_fill_skb().\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops-\u003ecreate is not addressed here."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only via local syscalls on an AF_PACKET socket with PACKET_TX_RING configured (sendmsg on mmap ring frames); it is not triggered by processing remotely received network traffic.\nAC:L - An attacker can open the TX_RING socket and concurrently reconfigure the bound netdev (e.g., VLAN/bonding/macvlan changes) in a user+network namespace, controlling both sides of the hard_header_len race without depending on external timing.\nPR:L - Exploitation requires CAP_NET_RAW to create AF_PACKET sockets and CAP_NET_ADMIN to change netdev hard_header_len; both are obtainable by an unprivileged user inside a user namespace without init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug using their own packet socket, TX_RING, and netdev reconfiguration threads.\nS:U - Impact is kernel heap corruption and local privilege escalation within the same kernel security domain; it does not constitute a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:H - Racing hard_header_len can make skb_push exceed reserved headroom or skb_put use a negative length (huge unsigned), and subsequent skb_store_bits writes before skb-\u003ehead or far past skb-\u003etail, corrupting adjacent slab objects and enabling kernel memory disclosure.\nI:H - Inconsistent hard_header_len between skb allocation and tpacket_fill_skb causes out-of-bounds linear expansion and data writes in the skb buffer, yielding heap corruption primitives suitable for control-flow hijacking and local privilege escalation.\nA:H - Corrupted skb_push/put operations invoke skb_under_panic or skb_over_panic (BUG), causing kernel oops/panic and reliable denial of service even when exploitation is not completed."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:40:01.903Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9c7e8ff48c377bef18c3d178748aea0575b69ede"
},
{
"url": "https://git.kernel.org/stable/c/2a73b2c37ee3060a880b53cd24783d93fc7be5f8"
},
{
"url": "https://git.kernel.org/stable/c/e79f59a8527a49078cfaf8fe8fb5fcefc20c76d2"
},
{
"url": "https://git.kernel.org/stable/c/d85d2fd54e901637c81d847811e03c662aee13cd"
},
{
"url": "https://git.kernel.org/stable/c/016763e829cac37b3234eace86fd0a4c560de4a7"
},
{
"url": "https://git.kernel.org/stable/c/27e068d1b35dbec10a3cf268887c94407be4badc"
},
{
"url": "https://git.kernel.org/stable/c/d48ea5c9c4c34dc0df621f0e39ed3a16b644621a"
},
{
"url": "https://git.kernel.org/stable/c/21b5953e7494c16a42e6cd8cf110e18d13ae4a6b"
}
],
"title": "packet: use consistent hard_header_len in TX_RING send path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74668",
"datePublished": "2026-08-22T15:32:39.583Z",
"dateReserved": "2026-08-15T05:44:03.924Z",
"dateUpdated": "2026-08-27T12:40:01.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…