CVE-2026-74310

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74310", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.883Z", "datePublished": "2026-08-15T05:58:10.043Z", "dateUpdated": "2026-10-16T18:55:32.036Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:45:42.723Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost/net: complete zerocopy ubufs only once\n\nvhost-net initializes one ubuf_info per outstanding zerocopy TX\ndescriptor and hands it to the backend socket. The networking stack may\nthen clone a zerocopy skb before all skb references are released. For\nexample, batman-adv fragmentation reaches skb_split(), which calls\nskb_zerocopy_clone() and increments the same ubuf_info refcount.\n\nvhost_zerocopy_complete() currently treats every ubuf callback as a\ncompleted vhost descriptor. It dereferences ubuf->ctx, writes the\ndescriptor completion state, and drops the vhost_net_ubuf_ref even when\nthe callback only releases a cloned skb reference. A backend reset can\ntherefore wait for and free the vhost_net_ubuf_ref while another cloned\nskb still carries the same ubuf_info. A later completion then\ndereferences the freed ubufs pointer.\n\nKASAN reports the stale completion as:\n\n BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7/0x1f0\n BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x101/0x1f0\n vhost_zerocopy_complete\n skb_copy_ubufs\n __dev_forward_skb2\n veth_xmit\n\nThe freed object was allocated from vhost_net_ioctl() while setting the\nbackend and freed through kfree_rcu()/kvfree_rcu_bulk after backend\nremoval, while delayed skb completion still reached\nvhost_zerocopy_complete().\n\nHonor the generic ubuf_info refcount before touching vhost state, and run\nthe vhost descriptor completion only for the final ubuf reference. This\nmatches the msg_zerocopy_complete() ownership rule for cloned zerocopy\nskbs."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.3, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is only reachable on the vhost-net TX zerocopy path via /dev/vhost-net ioctls or virtio-net TX descriptors handled by the host vhost worker; remote wire packets do not carry vhost ubuf_info state, so no network-facing host protocol reaches vhost_zerocopy_complete().\nAC:L - Once experimental_zcopytx is enabled, an attacker can reliably send >=256-byte zerocopy TX frames through a tap/veth backend so skb_zerocopy_clone/skb_copy_ubufs fires, then force backend teardown via VHOST_NET_SET_BACKEND or VM stop/migration while cloned completions remain pending.\nPR:N - A malicious KVM guest on a host using vhost-net needs no host root, capabilities, or /dev/vhost-net access\u2014only control of virtio TX descriptors and normal VM networking; a host-side attacker can also open /dev/vhost-net with only device-node permissions because drivers/vhost performs no capable() checks.\nUI:N - No victim user interaction is required beyond standard VM or vhost-net operation; the attacker directly drives virtio TX traffic, optional veth forwarding that clones zerocopy skbs, and backend reset/teardown that frees vhost_net_ubuf_ref while stale ubuf completions are still outstanding.\nS:C - In the standard KVM deployment, vhost-net is host-kernel code enforcing the guest NIC boundary; the slab use-after-free in vhost_zerocopy_complete executes in host context from guest-supplied zerocopy TX, corrupting host vhost/virtqueue state outside the guest security authority.\nC:H - This is a slab use-after-free: after premature completion frees vhost_net_ubuf_ref, a later skb_zcopy_clear callback dereferences freed ubuf->ctx/ubufs memory in vhost_zerocopy_complete, giving attacker-influenced UAF primitives suitable for arbitrary kernel memory disclosure.\nI:H - The stale completion writes vq->heads[ubuf->desc].len and decrements vhost_net_ubuf_ref on freed structures; UAF heap corruption of this class is leveragable into arbitrary write and host control-flow hijacking, including potential VM-to-host privilege escalation.\nA:H - KASAN reports slab-use-after-free in vhost_zerocopy_complete during skb_copy_ubufs/veth_xmit completion; this readily causes host kernel oops or panic and can be retriggered from a virtio guest TX loop or repeated backend resets until the host or hypervisor is unavailable."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vhost/net.c"], "versions": [{"version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "ea71f873423fb73e66ad88936d6759ac0ad4aa53", "status": "affected", "versionType": "git"}, {"version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "6445b945024f4c7675ae5352b2d5885cb1deea71", "status": "affected", "versionType": "git"}, {"version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d", "status": "affected", "versionType": "git"}, {"version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "321c73baf54d971ce3771fea275c98a247f7ee35", "status": "affected", "versionType": "git"}, {"version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "c069437924663539a93a1e5afe90838d9ccee284", "status": "affected", "versionType": "git"}, {"version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "8f6898fe80794f2d7c3d38c1158c806e4074a1c4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vhost/net.c"], "versions": [{"version": "3.1", "status": "affected"}, {"version": "0", "lessThan": "3.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ea71f873423fb73e66ad88936d6759ac0ad4aa53"}, {"url": "https://git.kernel.org/stable/c/6445b945024f4c7675ae5352b2d5885cb1deea71"}, {"url": "https://git.kernel.org/stable/c/a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d"}, {"url": "https://git.kernel.org/stable/c/321c73baf54d971ce3771fea275c98a247f7ee35"}, {"url": "https://git.kernel.org/stable/c/c069437924663539a93a1e5afe90838d9ccee284"}, {"url": "https://git.kernel.org/stable/c/8f6898fe80794f2d7c3d38c1158c806e4074a1c4"}], "title": "vhost/net: complete zerocopy ubufs only once", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74310", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:52:56.702664Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:32.036Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74310", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:52:56.702664Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:52:57.619Z"}}], "cna": {"title": "vhost/net: complete zerocopy ubufs only once", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is only reachable on the vhost-net TX zerocopy path via /dev/vhost-net ioctls or virtio-net TX descriptors handled by the host vhost worker; remote wire packets do not carry vhost ubuf_info state, so no network-facing host protocol reaches vhost_zerocopy_complete().\nAC:L - Once experimental_zcopytx is enabled, an attacker can reliably send >=256-byte zerocopy TX frames through a tap/veth backend so skb_zerocopy_clone/skb_copy_ubufs fires, then force backend teardown via VHOST_NET_SET_BACKEND or VM stop/migration while cloned completions remain pending.\nPR:N - A malicious KVM guest on a host using vhost-net needs no host root, capabilities, or /dev/vhost-net access\u2014only control of virtio TX descriptors and normal VM networking; a host-side attacker can also open /dev/vhost-net with only device-node permissions because drivers/vhost performs no capable() checks.\nUI:N - No victim user interaction is required beyond standard VM or vhost-net operation; the attacker directly drives virtio TX traffic, optional veth forwarding that clones zerocopy skbs, and backend reset/teardown that frees vhost_net_ubuf_ref while stale ubuf completions are still outstanding.\nS:C - In the standard KVM deployment, vhost-net is host-kernel code enforcing the guest NIC boundary; the slab use-after-free in vhost_zerocopy_complete executes in host context from guest-supplied zerocopy TX, corrupting host vhost/virtqueue state outside the guest security authority.\nC:H - This is a slab use-after-free: after premature completion frees vhost_net_ubuf_ref, a later skb_zcopy_clear callback dereferences freed ubuf->ctx/ubufs memory in vhost_zerocopy_complete, giving attacker-influenced UAF primitives suitable for arbitrary kernel memory disclosure.\nI:H - The stale completion writes vq->heads[ubuf->desc].len and decrements vhost_net_ubuf_ref on freed structures; UAF heap corruption of this class is leveragable into arbitrary write and host control-flow hijacking, including potential VM-to-host privilege escalation.\nA:H - KASAN reports slab-use-after-free in vhost_zerocopy_complete during skb_copy_ubufs/veth_xmit completion; this readily causes host kernel oops or panic and can be retriggered from a virtio guest TX loop or repeated backend resets until the host or hypervisor is unavailable."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "ea71f873423fb73e66ad88936d6759ac0ad4aa53", "versionType": "git"}, {"status": "affected", "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "6445b945024f4c7675ae5352b2d5885cb1deea71", "versionType": "git"}, {"status": "affected", "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d", "versionType": "git"}, {"status": "affected", "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "321c73baf54d971ce3771fea275c98a247f7ee35", "versionType": "git"}, {"status": "affected", "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "c069437924663539a93a1e5afe90838d9ccee284", "versionType": "git"}, {"status": "affected", "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "8f6898fe80794f2d7c3d38c1158c806e4074a1c4", "versionType": "git"}], "programFiles": ["drivers/vhost/net.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.1"}, {"status": "unaffected", "version": "0", "lessThan": "3.1", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/vhost/net.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ea71f873423fb73e66ad88936d6759ac0ad4aa53"}, {"url": "https://git.kernel.org/stable/c/6445b945024f4c7675ae5352b2d5885cb1deea71"}, {"url": "https://git.kernel.org/stable/c/a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d"}, {"url": "https://git.kernel.org/stable/c/321c73baf54d971ce3771fea275c98a247f7ee35"}, {"url": "https://git.kernel.org/stable/c/c069437924663539a93a1e5afe90838d9ccee284"}, {"url": "https://git.kernel.org/stable/c/8f6898fe80794f2d7c3d38c1158c806e4074a1c4"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost/net: complete zerocopy ubufs only once\n\nvhost-net initializes one ubuf_info per outstanding zerocopy TX\ndescriptor and hands it to the backend socket. The networking stack may\nthen clone a zerocopy skb before all skb references are released. For\nexample, batman-adv fragmentation reaches skb_split(), which calls\nskb_zerocopy_clone() and increments the same ubuf_info refcount.\n\nvhost_zerocopy_complete() currently treats every ubuf callback as a\ncompleted vhost descriptor. It dereferences ubuf->ctx, writes the\ndescriptor completion state, and drops the vhost_net_ubuf_ref even when\nthe callback only releases a cloned skb reference. A backend reset can\ntherefore wait for and free the vhost_net_ubuf_ref while another cloned\nskb still carries the same ubuf_info. A later completion then\ndereferences the freed ubufs pointer.\n\nKASAN reports the stale completion as:\n\n BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7/0x1f0\n BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x101/0x1f0\n vhost_zerocopy_complete\n skb_copy_ubufs\n __dev_forward_skb2\n veth_xmit\n\nThe freed object was allocated from vhost_net_ioctl() while setting the\nbackend and freed through kfree_rcu()/kvfree_rcu_bulk after backend\nremoval, while delayed skb completion still reached\nvhost_zerocopy_complete().\n\nHonor the generic ubuf_info refcount before touching vhost state, and run\nthe vhost descriptor completion only for the final ubuf reference. This\nmatches the msg_zerocopy_complete() ownership rule for cloned zerocopy\nskbs."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "3.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:45:42.723Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74310", "state": "PUBLISHED", "dateUpdated": "2026-10-16T18:55:32.036Z", "dateReserved": "2026-08-15T05:44:03.883Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:58:10.043Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/vhost/net.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ea71f873423fb73e66ad88936d6759ac0ad4aa53", "status": "affected", "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "versionType": "git"}, {"lessThan": "6445b945024f4c7675ae5352b2d5885cb1deea71", "status": "affected", "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "versionType": "git"}, {"lessThan": "a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d", "status": "affected", "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "versionType": "git"}, {"lessThan": "321c73baf54d971ce3771fea275c98a247f7ee35", "status": "affected", "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "versionType": "git"}, {"lessThan": "c069437924663539a93a1e5afe90838d9ccee284", "status": "affected", "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "versionType": "git"}, {"lessThan": "8f6898fe80794f2d7c3d38c1158c806e4074a1c4", "status": "affected", "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/vhost/net.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.1"}, {"lessThan": "3.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost/net: complete zerocopy ubufs only once\n\nvhost-net initializes one ubuf_info per outstanding zerocopy TX\ndescriptor and hands it to the backend socket. The networking stack may\nthen clone a zerocopy skb before all skb references are released. For\nexample, batman-adv fragmentation reaches skb_split(), which calls\nskb_zerocopy_clone() and increments the same ubuf_info refcount.\n\nvhost_zerocopy_complete() currently treats every ubuf callback as a\ncompleted vhost descriptor. It dereferences ubuf->ctx, writes the\ndescriptor completion state, and drops the vhost_net_ubuf_ref even when\nthe callback only releases a cloned skb reference. A backend reset can\ntherefore wait for and free the vhost_net_ubuf_ref while another cloned\nskb still carries the same ubuf_info. A later completion then\ndereferences the freed ubufs pointer.\n\nKASAN reports the stale completion as:\n\n BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7/0x1f0\n BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x101/0x1f0\n vhost_zerocopy_complete\n skb_copy_ubufs\n __dev_forward_skb2\n veth_xmit\n\nThe freed object was allocated from vhost_net_ioctl() while setting the\nbackend and freed through kfree_rcu()/kvfree_rcu_bulk after backend\nremoval, while delayed skb completion still reached\nvhost_zerocopy_complete().\n\nHonor the generic ubuf_info refcount before touching vhost state, and run\nthe vhost descriptor completion only for the final ubuf reference. This\nmatches the msg_zerocopy_complete() ownership rule for cloned zerocopy\nskbs."}], "id": "CVE-2026-74310", "lastModified": "2026-10-16T19:17:38.347", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74310", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:52:56.702664Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:30.987", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/321c73baf54d971ce3771fea275c98a247f7ee35"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6445b945024f4c7675ae5352b2d5885cb1deea71"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8f6898fe80794f2d7c3d38c1158c806e4074a1c4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c069437924663539a93a1e5afe90838d9ccee284"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ea71f873423fb73e66ad88936d6759ac0ad4aa53"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: vhost/net: complete zerocopy ubufs only once", "id": "2516756", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516756"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvhost/net: complete zerocopy ubufs only once\nvhost-net initializes one ubuf_info per outstanding zerocopy TX\ndescriptor and hands it to the backend socket. The networking stack may\nthen clone a zerocopy skb before all skb references are released. For\nexample, batman-adv fragmentation reaches skb_split(), which calls\nskb_zerocopy_clone() and increments the same ubuf_info refcount.\nvhost_zerocopy_complete() currently treats every ubuf callback as a\ncompleted vhost descriptor. It dereferences ubuf->ctx, writes the\ndescriptor completion state, and drops the vhost_net_ubuf_ref even when\nthe callback only releases a cloned skb reference. A backend reset can\ntherefore wait for and free the vhost_net_ubuf_ref while another cloned\nskb still carries the same ubuf_info. A later completion then\ndereferences the freed ubufs pointer.\nKASAN reports the stale completion as:\nBUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7/0x1f0\nBUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x101/0x1f0\nvhost_zerocopy_complete\nskb_copy_ubufs\n__dev_forward_skb2\nveth_xmit\nThe freed object was allocated from vhost_net_ioctl() while setting the\nbackend and freed through kfree_rcu()/kvfree_rcu_bulk after backend\nremoval, while delayed skb completion still reached\nvhost_zerocopy_complete().\nHonor the generic ubuf_info refcount before touching vhost state, and run\nthe vhost descriptor completion only for the final ubuf reference. This\nmatches the msg_zerocopy_complete() ownership rule for cloned zerocopy\nskbs.", "A flaw was found in the Linux kernel's `vhost/net` component. This use-after-free vulnerability occurs due to incorrect handling of zerocopy user buffers, where the system may prematurely complete buffer operations while other parts of the system still hold references to the same memory. This can lead to memory corruption and potentially a denial of service (DoS) condition, causing system instability."], "name": "CVE-2026-74310", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74310\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74310\nhttps://lore.kernel.org/linux-cve-announce/2026081551-CVE-2026-74310-06ad@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bab632d69ee48a106e779b60cc01adfe80a72807,ea71f873423fb73e66ad88936d6759ac0ad4aa53)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bab632d69ee48a106e779b60cc01adfe80a72807,6445b945024f4c7675ae5352b2d5885cb1deea71)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bab632d69ee48a106e779b60cc01adfe80a72807,a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bab632d69ee48a106e779b60cc01adfe80a72807,321c73baf54d971ce3771fea275c98a247f7ee35)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bab632d69ee48a106e779b60cc01adfe80a72807,c069437924663539a93a1e5afe90838d9ccee284)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bab632d69ee48a106e779b60cc01adfe80a72807,8f6898fe80794f2d7c3d38c1158c806e4074a1c4)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T16:45:10.769990+00:00", "updated": "2026-08-22T00:30:16.958452+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}