FKIE_CVE-2026-74662

Vulnerability from fkie_nvd - Published: 2026-08-22 16:16 - Updated: 2026-10-16 20:17
Severity
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/08a04d7bfb9c103432561aff8a62b6872e694a6a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4ed0681dc2c1e0538b79d2fc56190ffcb369dacd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/653d7ddf6cba867777a3d14c4f83ace008c5ad13
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/928128865e43b197e30688dc1bc991592c97edcf
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9f904dd3e455750e5d4ec9b2f134835811b85a2f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d3ffb89b2944672cf7bdd8e9ee577d2043b4a956
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f4e4dab62181b7fe7c011bed6fbef9fc3d48c769
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/inet_fragment.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f4e4dab62181b7fe7c011bed6fbef9fc3d48c769",
              "status": "affected",
              "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
              "versionType": "git"
            },
            {
              "lessThan": "4ed0681dc2c1e0538b79d2fc56190ffcb369dacd",
              "status": "affected",
              "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
              "versionType": "git"
            },
            {
              "lessThan": "08a04d7bfb9c103432561aff8a62b6872e694a6a",
              "status": "affected",
              "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
              "versionType": "git"
            },
            {
              "lessThan": "d3ffb89b2944672cf7bdd8e9ee577d2043b4a956",
              "status": "affected",
              "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
              "versionType": "git"
            },
            {
              "lessThan": "39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0",
              "status": "affected",
              "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
              "versionType": "git"
            },
            {
              "lessThan": "9f904dd3e455750e5d4ec9b2f134835811b85a2f",
              "status": "affected",
              "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
              "versionType": "git"
            },
            {
              "lessThan": "928128865e43b197e30688dc1bc991592c97edcf",
              "status": "affected",
              "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
              "versionType": "git"
            },
            {
              "lessThan": "653d7ddf6cba867777a3d14c4f83ace008c5ad13",
              "status": "affected",
              "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "493107105843f299662b3b664a83804645564f12",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.174",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/inet_fragment.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: publish queues before arming timer\n\ninet_frag_create() arms the fragment queue timer before inserting the\nqueue into the fqdir rhashtable. If the namespace fragment timeout is\nzero or negative, the timer can run before the queue is published.\n\nThe timer callback then marks the queue complete, tries to remove a node\nthat is not in the hash table yet, and drops the anticipated hash\nreference. Creation can subsequently publish the completed queue without\nrestoring that reference, leaving a stale hash node after the caller drops\nthe remaining reference.\n\nPublish the queue first and arm the timer while holding the queue lock.\nThis makes timer expiry wait until the queue is visible in the hash table,\nso inet_frag_kill() can remove the node and balance the hash reference."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ninet: frags: publicar colas antes de armar el temporizador\n\ninet_frag_create() arma el temporizador de la cola de fragmentos antes de insertar la cola en la rhashtable fqdir. Si el tiempo de espera de fragmentos del espacio de nombres es cero o negativo, el temporizador puede ejecutarse antes de que la cola sea publicada.\n\nLa devoluci\u00f3n de llamada del temporizador luego marca la cola como completa, intenta eliminar un nodo que a\u00fan no est\u00e1 en la tabla hash y descarta la referencia hash anticipada. La creaci\u00f3n puede publicar posteriormente la cola completada sin restaurar esa referencia, dejando un nodo hash obsoleto despu\u00e9s de que el llamador descarta la referencia restante.\n\nPublicar la cola primero y armar el temporizador mientras se mantiene el bloqueo de la cola. Esto hace que la expiraci\u00f3n del temporizador espere hasta que la cola sea visible en la tabla hash, para que inet_frag_kill() pueda eliminar el nodo y equilibrar la referencia hash."
    }
  ],
  "id": "CVE-2026-74662",
  "lastModified": "2026-10-16T20:17:50.227",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-74662",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-16T19:14:06.842861Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-22T16:16:39.993",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/08a04d7bfb9c103432561aff8a62b6872e694a6a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4ed0681dc2c1e0538b79d2fc56190ffcb369dacd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/653d7ddf6cba867777a3d14c4f83ace008c5ad13"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/928128865e43b197e30688dc1bc991592c97edcf"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9f904dd3e455750e5d4ec9b2f134835811b85a2f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d3ffb89b2944672cf7bdd8e9ee577d2043b4a956"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f4e4dab62181b7fe7c011bed6fbef9fc3d48c769"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.