CVE-2026-74479

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74479", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.904Z", "datePublished": "2026-08-15T12:27:13.172Z", "dateUpdated": "2026-10-16T19:05:48.651Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:47:23.408Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pktgen: fix proc entry use-after-free\n\npktgen_change_name() replaces pkt_dev->entry while holding t->if_lock.\npktgen_remove_device() removes the same entry before\n_rem_dev_from_if_list() takes that lock.\n\nThis allows the following interleaving:\n\n CPU 0 (NETDEV_CHANGENAME) CPU 1 (kpktgend)\n if_lock(t)\n proc_remove(pkt_dev->entry)\n proc_remove(pkt_dev->entry)\n pkt_dev->entry = proc_create_data(...)\n if_unlock(t)\n\nThe kthread can pass the stale proc_dir_entry to proc_remove() after the\nrename path has freed it. A reproducer with a widened race window reports:\n\n BUG: KASAN: slab-use-after-free in proc_remove+0x78/0x80\n Read of size 8 at addr ffff8881478fea70 by task kpktgend_0/67\n Call Trace:\n proc_remove+0x78/0x80\n pktgen_remove_device.isra.0+0x11c/0x4c0\n pktgen_thread_worker+0x1214/0x6bc0\n kthread+0x2c6/0x3b0\n Allocated by task 95:\n __proc_create+0x204/0x790\n proc_create_data+0x72/0xe0\n pktgen_thread_write+0xd61/0x1510\n Freed by task 28:\n kmem_cache_free+0xcb/0x3d0\n proc_free_inode+0x5b/0x80\n rcu_core+0x50a/0x1850\n The buggy address belongs to the object at ffff8881478fea00\n which belongs to the cache proc_dir_entry of size 192\n\nMove proc_remove() into the if_lock-protected list removal helper. Keep it\nbefore list_del_rcu() to preserve the ordering required by add_device().\nThe rename path must then finish replacing the entry before removal, or\nit observes that the device is no longer on the list."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local access to /proc/net/pktgen procfs writes and a SIOCSIFNAME/ip-link rename of a pktgen-bound netdev; pktgen is configured only via local proc and ioctl paths, not via remote network packets.\nAC:L - The UAF is a race between pktgen_change_name() on NETDEV_CHANGENAME and pktgen_remove_device() in kpktgend; an attacker controls both sides concurrently via rem_device_all/unregister and interface rename, so success does not depend on uncontrollable timing.\nPR:L - Triggering rename needs ns_capable(CAP_NET_ADMIN) and pktgen proc writes are mode 0600; CAP_NET_ADMIN is obtainable by an unprivileged user via user/network namespaces (unshare -Urn), so real init-namespace root is not required.\nUI:N - No victim interaction is required; the attacker drives pktgen device add/remove and netdev rename/unregister directly through local proc writes and netlink/ioctl without needing another user to act.\nS:U - Impact is kernel slab corruption and potential privilege escalation within the same kernel security domain; it does not inherently cross VM, container, or IOMMU boundaries without additional unrelated primitives.\nC:H - The bug is a slab use-after-free of a proc_dir_entry in proc_remove(); KASAN shows reads of freed 192-byte objects, and UAF on proc metadata can be turned into arbitrary kernel memory disclosure via heap grooming.\nI:H - Corrupting or reusing the freed proc_dir_entry during proc_remove()/procfs teardown can enable attacker-controlled writes and control-flow hijack in kernel context, not merely a benign NULL dereference crash.\nA:H - Concurrent rename and removal causes proc_remove() to dereference a freed proc_dir_entry, producing KASAN slab-use-after-free and kernel oops/panic; even without full exploit development, the UAF reliably threatens system availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/pktgen.c"], "versions": [{"version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "lessThan": "82ed3db9269cb61e3c15bad2f6e221efce90e1e0", "status": "affected", "versionType": "git"}, {"version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "lessThan": "d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4", "status": "affected", "versionType": "git"}, {"version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "lessThan": "7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4", "status": "affected", "versionType": "git"}, {"version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "lessThan": "577443530cb592d5782a1f79847411a9363a65c8", "status": "affected", "versionType": "git"}, {"version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "lessThan": "f85a58340b91f225de3299dfa782c6414098077c", "status": "affected", "versionType": "git"}, {"version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "lessThan": "4ef801b838d85c0ea5852c50667f7344ce3b6cd0", "status": "affected", "versionType": "git"}, {"version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "lessThan": "b006a5404470bd3eb2aa0425fc447183032047ef", "status": "affected", "versionType": "git"}, {"version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "lessThan": "817ff6efdb7f484ea547218e11e17d8e43daa3b4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/pktgen.c"], "versions": [{"version": "2.6.22", "status": "affected"}, {"version": "0", "lessThan": "2.6.22", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.266", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.153", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.105", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "5.10.266"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "5.15.217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.1.184"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.6.153"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.12.105"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/82ed3db9269cb61e3c15bad2f6e221efce90e1e0"}, {"url": "https://git.kernel.org/stable/c/d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4"}, {"url": "https://git.kernel.org/stable/c/7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4"}, {"url": "https://git.kernel.org/stable/c/577443530cb592d5782a1f79847411a9363a65c8"}, {"url": "https://git.kernel.org/stable/c/f85a58340b91f225de3299dfa782c6414098077c"}, {"url": "https://git.kernel.org/stable/c/4ef801b838d85c0ea5852c50667f7344ce3b6cd0"}, {"url": "https://git.kernel.org/stable/c/b006a5404470bd3eb2aa0425fc447183032047ef"}, {"url": "https://git.kernel.org/stable/c/817ff6efdb7f484ea547218e11e17d8e43daa3b4"}], "title": "net: pktgen: fix proc entry use-after-free", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74479", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:57:37.706862Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:05:48.651Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74479", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:57:37.706862Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:57:38.603Z"}}], "cna": {"title": "net: pktgen: fix proc entry use-after-free", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local access to /proc/net/pktgen procfs writes and a SIOCSIFNAME/ip-link rename of a pktgen-bound netdev; pktgen is configured only via local proc and ioctl paths, not via remote network packets.\nAC:L - The UAF is a race between pktgen_change_name() on NETDEV_CHANGENAME and pktgen_remove_device() in kpktgend; an attacker controls both sides concurrently via rem_device_all/unregister and interface rename, so success does not depend on uncontrollable timing.\nPR:L - Triggering rename needs ns_capable(CAP_NET_ADMIN) and pktgen proc writes are mode 0600; CAP_NET_ADMIN is obtainable by an unprivileged user via user/network namespaces (unshare -Urn), so real init-namespace root is not required.\nUI:N - No victim interaction is required; the attacker drives pktgen device add/remove and netdev rename/unregister directly through local proc writes and netlink/ioctl without needing another user to act.\nS:U - Impact is kernel slab corruption and potential privilege escalation within the same kernel security domain; it does not inherently cross VM, container, or IOMMU boundaries without additional unrelated primitives.\nC:H - The bug is a slab use-after-free of a proc_dir_entry in proc_remove(); KASAN shows reads of freed 192-byte objects, and UAF on proc metadata can be turned into arbitrary kernel memory disclosure via heap grooming.\nI:H - Corrupting or reusing the freed proc_dir_entry during proc_remove()/procfs teardown can enable attacker-controlled writes and control-flow hijack in kernel context, not merely a benign NULL dereference crash.\nA:H - Concurrent rename and removal causes proc_remove() to dereference a freed proc_dir_entry, producing KASAN slab-use-after-free and kernel oops/panic; even without full exploit development, the UAF reliably threatens system availability."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "lessThan": "82ed3db9269cb61e3c15bad2f6e221efce90e1e0", "versionType": "git"}, {"status": "affected", "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "lessThan": "d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4", "versionType": "git"}, {"status": "affected", "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "lessThan": "7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4", "versionType": "git"}, {"status": "affected", "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "lessThan": "577443530cb592d5782a1f79847411a9363a65c8", "versionType": "git"}, {"status": "affected", "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "lessThan": "f85a58340b91f225de3299dfa782c6414098077c", "versionType": "git"}, {"status": "affected", "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "lessThan": "4ef801b838d85c0ea5852c50667f7344ce3b6cd0", "versionType": "git"}, {"status": "affected", "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "lessThan": "b006a5404470bd3eb2aa0425fc447183032047ef", "versionType": "git"}, {"status": "affected", "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "lessThan": "817ff6efdb7f484ea547218e11e17d8e43daa3b4", "versionType": "git"}], "programFiles": ["net/core/pktgen.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.22"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.22", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.266", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.217", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.184", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.153", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.105", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.44", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.8", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/core/pktgen.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/82ed3db9269cb61e3c15bad2f6e221efce90e1e0"}, {"url": "https://git.kernel.org/stable/c/d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4"}, {"url": "https://git.kernel.org/stable/c/7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4"}, {"url": "https://git.kernel.org/stable/c/577443530cb592d5782a1f79847411a9363a65c8"}, {"url": "https://git.kernel.org/stable/c/f85a58340b91f225de3299dfa782c6414098077c"}, {"url": "https://git.kernel.org/stable/c/4ef801b838d85c0ea5852c50667f7344ce3b6cd0"}, {"url": "https://git.kernel.org/stable/c/b006a5404470bd3eb2aa0425fc447183032047ef"}, {"url": "https://git.kernel.org/stable/c/817ff6efdb7f484ea547218e11e17d8e43daa3b4"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pktgen: fix proc entry use-after-free\n\npktgen_change_name() replaces pkt_dev->entry while holding t->if_lock.\npktgen_remove_device() removes the same entry before\n_rem_dev_from_if_list() takes that lock.\n\nThis allows the following interleaving:\n\n CPU 0 (NETDEV_CHANGENAME) CPU 1 (kpktgend)\n if_lock(t)\n proc_remove(pkt_dev->entry)\n proc_remove(pkt_dev->entry)\n pkt_dev->entry = proc_create_data(...)\n if_unlock(t)\n\nThe kthread can pass the stale proc_dir_entry to proc_remove() after the\nrename path has freed it. A reproducer with a widened race window reports:\n\n BUG: KASAN: slab-use-after-free in proc_remove+0x78/0x80\n Read of size 8 at addr ffff8881478fea70 by task kpktgend_0/67\n Call Trace:\n proc_remove+0x78/0x80\n pktgen_remove_device.isra.0+0x11c/0x4c0\n pktgen_thread_worker+0x1214/0x6bc0\n kthread+0x2c6/0x3b0\n Allocated by task 95:\n __proc_create+0x204/0x790\n proc_create_data+0x72/0xe0\n pktgen_thread_write+0xd61/0x1510\n Freed by task 28:\n kmem_cache_free+0xcb/0x3d0\n proc_free_inode+0x5b/0x80\n rcu_core+0x50a/0x1850\n The buggy address belongs to the object at ffff8881478fea00\n which belongs to the cache proc_dir_entry of size 192\n\nMove proc_remove() into the if_lock-protected list removal helper. Keep it\nbefore list_del_rcu() to preserve the ordering required by add_device().\nThe rename path must then finish replacing the entry before removal, or\nit observes that the device is no longer on the list."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.266", "versionStartIncluding": "2.6.22"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.217", "versionStartIncluding": "2.6.22"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.184", "versionStartIncluding": "2.6.22"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.153", "versionStartIncluding": "2.6.22"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.105", "versionStartIncluding": "2.6.22"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.44", "versionStartIncluding": "2.6.22"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.8", "versionStartIncluding": "2.6.22"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "2.6.22"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:47:23.408Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74479", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:05:48.651Z", "dateReserved": "2026-08-15T05:44:03.904Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T12:27:13.172Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/pktgen.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "82ed3db9269cb61e3c15bad2f6e221efce90e1e0", "status": "affected", "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "versionType": "git"}, {"lessThan": "d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4", "status": "affected", "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "versionType": "git"}, {"lessThan": "7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4", "status": "affected", "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "versionType": "git"}, {"lessThan": "577443530cb592d5782a1f79847411a9363a65c8", "status": "affected", "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "versionType": "git"}, {"lessThan": "f85a58340b91f225de3299dfa782c6414098077c", "status": "affected", "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "versionType": "git"}, {"lessThan": "4ef801b838d85c0ea5852c50667f7344ce3b6cd0", "status": "affected", "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "versionType": "git"}, {"lessThan": "b006a5404470bd3eb2aa0425fc447183032047ef", "status": "affected", "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "versionType": "git"}, {"lessThan": "817ff6efdb7f484ea547218e11e17d8e43daa3b4", "status": "affected", "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/pktgen.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.22"}, {"lessThan": "2.6.22", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.266", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.217", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.184", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.153", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.105", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pktgen: fix proc entry use-after-free\n\npktgen_change_name() replaces pkt_dev->entry while holding t->if_lock.\npktgen_remove_device() removes the same entry before\n_rem_dev_from_if_list() takes that lock.\n\nThis allows the following interleaving:\n\n CPU 0 (NETDEV_CHANGENAME) CPU 1 (kpktgend)\n if_lock(t)\n proc_remove(pkt_dev->entry)\n proc_remove(pkt_dev->entry)\n pkt_dev->entry = proc_create_data(...)\n if_unlock(t)\n\nThe kthread can pass the stale proc_dir_entry to proc_remove() after the\nrename path has freed it. A reproducer with a widened race window reports:\n\n BUG: KASAN: slab-use-after-free in proc_remove+0x78/0x80\n Read of size 8 at addr ffff8881478fea70 by task kpktgend_0/67\n Call Trace:\n proc_remove+0x78/0x80\n pktgen_remove_device.isra.0+0x11c/0x4c0\n pktgen_thread_worker+0x1214/0x6bc0\n kthread+0x2c6/0x3b0\n Allocated by task 95:\n __proc_create+0x204/0x790\n proc_create_data+0x72/0xe0\n pktgen_thread_write+0xd61/0x1510\n Freed by task 28:\n kmem_cache_free+0xcb/0x3d0\n proc_free_inode+0x5b/0x80\n rcu_core+0x50a/0x1850\n The buggy address belongs to the object at ffff8881478fea00\n which belongs to the cache proc_dir_entry of size 192\n\nMove proc_remove() into the if_lock-protected list removal helper. Keep it\nbefore list_del_rcu() to preserve the ordering required by add_device().\nThe rename path must then finish replacing the entry before removal, or\nit observes that the device is no longer on the list."}], "id": "CVE-2026-74479", "lastModified": "2026-10-16T20:17:30.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74479", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:57:37.706862Z", "version": "2.0.3"}}]}, "published": "2026-08-15T13:17:52.713", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4ef801b838d85c0ea5852c50667f7344ce3b6cd0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/577443530cb592d5782a1f79847411a9363a65c8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/817ff6efdb7f484ea547218e11e17d8e43daa3b4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/82ed3db9269cb61e3c15bad2f6e221efce90e1e0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b006a5404470bd3eb2aa0425fc447183032047ef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f85a58340b91f225de3299dfa782c6414098077c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: pktgen: fix proc entry use-after-free", "id": "2517021", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517021"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-364", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: pktgen: fix proc entry use-after-free\npktgen_change_name() replaces pkt_dev->entry while holding t->if_lock.\npktgen_remove_device() removes the same entry before\n_rem_dev_from_if_list() takes that lock.\nThis allows the following interleaving:\nCPU 0 (NETDEV_CHANGENAME) CPU 1 (kpktgend)\nif_lock(t)\nproc_remove(pkt_dev->entry)\nproc_remove(pkt_dev->entry)\npkt_dev->entry = proc_create_data(...)\nif_unlock(t)\nThe kthread can pass the stale proc_dir_entry to proc_remove() after the\nrename path has freed it. A reproducer with a widened race window reports:\nBUG: KASAN: slab-use-after-free in proc_remove+0x78/0x80\nRead of size 8 at addr ffff8881478fea70 by task kpktgend_0/67\nCall Trace:\nproc_remove+0x78/0x80\npktgen_remove_device.isra.0+0x11c/0x4c0\npktgen_thread_worker+0x1214/0x6bc0\nkthread+0x2c6/0x3b0\nAllocated by task 95:\n__proc_create+0x204/0x790\nproc_create_data+0x72/0xe0\npktgen_thread_write+0xd61/0x1510\nFreed by task 28:\nkmem_cache_free+0xcb/0x3d0\nproc_free_inode+0x5b/0x80\nrcu_core+0x50a/0x1850\nThe buggy address belongs to the object at ffff8881478fea00\nwhich belongs to the cache proc_dir_entry of size 192\nMove proc_remove() into the if_lock-protected list removal helper. Keep it\nbefore list_del_rcu() to preserve the ordering required by add_device().\nThe rename path must then finish replacing the entry before removal, or\nit observes that the device is no longer on the list.", "A flaw was found in the Linux kernel's pktgen module. This vulnerability, a use-after-free, occurs due to a race condition when handling `proc` entries, which are kernel interfaces. A local attacker could exploit this timing issue to trigger a system crash, leading to a Denial of Service (DoS)."], "name": "CVE-2026-74479", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74479\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74479\nhttps://lore.kernel.org/linux-cve-announce/2026081536-CVE-2026-74479-0cd6@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[39df232f1a9ba48d41c68ee7d4046756e709cf91,4ef801b838d85c0ea5852c50667f7344ce3b6cd0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[39df232f1a9ba48d41c68ee7d4046756e709cf91,b006a5404470bd3eb2aa0425fc447183032047ef)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[39df232f1a9ba48d41c68ee7d4046756e709cf91,817ff6efdb7f484ea547218e11e17d8e43daa3b4)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.22"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,2.6.22)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T14:15:03.646171+00:00", "updated": "2026-08-21T22:00:15.014368+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}