CVE-2026-74590

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74590", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.918Z", "datePublished": "2026-08-22T15:31:41.929Z", "dateUpdated": "2026-10-16T19:05:59.372Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:17.568Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfsverity: Fix bpf_get_fsverity_digest() dynptr assumptions\n\nThe BPF verifier and the dynptr abstraction ensure that the memory space\nreferenced by a dynptr remains valid. They do not, however, provide any\nguarantee that the contents of the memory are stable. kfuncs are\nexpected to remain memory-safe even if concurrent modifications occur.\n\nbpf_get_fsverity_digest() didn't follow that: it could crash if\narg->digest_size was concurrently modified.\n\nFix that by using the known-good value hash_alg->digest_size instead.\n\nAlso widen 'dynptr_sz' and 'out_digest_sz' to u64 to match the return\ntype of __bpf_dynptr_size(). It doesn't appear that it can actually be\nmore than INT_MAX currently (since __bpf_dynptr_data_rw() excludes\nfile-based pointers), but the correct type might as well be used."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is only reachable via bpf_get_fsverity_digest(), a BPF kfunc callable from BPF LSM programs loaded through the bpf(2) syscall and triggered by local LSM hooks such as file_open, not by any network-facing kernel service.\nAC:L - Exploitation requires racing concurrent writes to the dynptr-backed fsverity_digest buffer (e.g., bpf_map_update_elem from a sibling thread) against the kfunc's memset; the attacker controls both sides of this race and can repeat it until the bad offset is hit.\nPR:L - Loading and attaching the required BPF LSM program needs CAP_BPF and CAP_PERFMON, which an unprivileged user can obtain as root inside a user namespace (unshare -Ur) without init-namespace privileges, matching kernel CNA guidance for BPF reachability.\nUI:N - No victim interaction is required; the attacker can load the LSM program, prepare a shared dynptr buffer, enable fsverity on a file they own, and trigger file_open themselves to invoke the vulnerable kfunc.\nS:U - Successful exploitation corrupts kernel heap memory and can yield local privilege escalation within the same kernel/host security boundary; it does not by itself cross a guest-to-host, sandbox, or IOMMU isolation boundary.\nC:H - Concurrent tampering with digest_size lets memset() use an attacker-chosen offset beyond the dynptr allocation, causing out-of-bounds kernel heap writes that can corrupt adjacent objects and be leveraged for arbitrary kernel memory disclosure.\nI:H - The faulty memset() can write large zeroed regions far outside the dynptr buffer, giving a controllable out-of-bounds heap write primitive that is exploitable for control-flow hijacking and arbitrary kernel code execution.\nA:H - An out-of-bounds heap write from kernel context can immediately oops/panic the kernel or destabilize critical structures, and the underlying memory corruption reliably threatens system availability even before full exploitation."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/verity/measure.c"], "versions": [{"version": "67814c00de3161181cddd06c77aeaf86ac4cc584", "lessThan": "1344b632cb5043e32939a84568125719111c5af3", "status": "affected", "versionType": "git"}, {"version": "67814c00de3161181cddd06c77aeaf86ac4cc584", "lessThan": "2a5cfcad1d56e26d645b7887b0ed24c371851525", "status": "affected", "versionType": "git"}, {"version": "67814c00de3161181cddd06c77aeaf86ac4cc584", "lessThan": "5bd63cad9df4328a184c409fbdad4f17944bcdb8", "status": "affected", "versionType": "git"}, {"version": "67814c00de3161181cddd06c77aeaf86ac4cc584", "lessThan": "3e8ec7c0387273329374f5c7bd61f5f38af71fe1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/verity/measure.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1344b632cb5043e32939a84568125719111c5af3"}, {"url": "https://git.kernel.org/stable/c/2a5cfcad1d56e26d645b7887b0ed24c371851525"}, {"url": "https://git.kernel.org/stable/c/5bd63cad9df4328a184c409fbdad4f17944bcdb8"}, {"url": "https://git.kernel.org/stable/c/3e8ec7c0387273329374f5c7bd61f5f38af71fe1"}], "title": "fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74590", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:01:35.901397Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:05:59.372Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74590", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:01:35.901397Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:01:36.504Z"}}], "cna": {"title": "fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is only reachable via bpf_get_fsverity_digest(), a BPF kfunc callable from BPF LSM programs loaded through the bpf(2) syscall and triggered by local LSM hooks such as file_open, not by any network-facing kernel service.\nAC:L - Exploitation requires racing concurrent writes to the dynptr-backed fsverity_digest buffer (e.g., bpf_map_update_elem from a sibling thread) against the kfunc's memset; the attacker controls both sides of this race and can repeat it until the bad offset is hit.\nPR:L - Loading and attaching the required BPF LSM program needs CAP_BPF and CAP_PERFMON, which an unprivileged user can obtain as root inside a user namespace (unshare -Ur) without init-namespace privileges, matching kernel CNA guidance for BPF reachability.\nUI:N - No victim interaction is required; the attacker can load the LSM program, prepare a shared dynptr buffer, enable fsverity on a file they own, and trigger file_open themselves to invoke the vulnerable kfunc.\nS:U - Successful exploitation corrupts kernel heap memory and can yield local privilege escalation within the same kernel/host security boundary; it does not by itself cross a guest-to-host, sandbox, or IOMMU isolation boundary.\nC:H - Concurrent tampering with digest_size lets memset() use an attacker-chosen offset beyond the dynptr allocation, causing out-of-bounds kernel heap writes that can corrupt adjacent objects and be leveraged for arbitrary kernel memory disclosure.\nI:H - The faulty memset() can write large zeroed regions far outside the dynptr buffer, giving a controllable out-of-bounds heap write primitive that is exploitable for control-flow hijacking and arbitrary kernel code execution.\nA:H - An out-of-bounds heap write from kernel context can immediately oops/panic the kernel or destabilize critical structures, and the underlying memory corruption reliably threatens system availability even before full exploitation."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "67814c00de3161181cddd06c77aeaf86ac4cc584", "lessThan": "1344b632cb5043e32939a84568125719111c5af3", "versionType": "git"}, {"status": "affected", "version": "67814c00de3161181cddd06c77aeaf86ac4cc584", "lessThan": "2a5cfcad1d56e26d645b7887b0ed24c371851525", "versionType": "git"}, {"status": "affected", "version": "67814c00de3161181cddd06c77aeaf86ac4cc584", "lessThan": "5bd63cad9df4328a184c409fbdad4f17944bcdb8", "versionType": "git"}, {"status": "affected", "version": "67814c00de3161181cddd06c77aeaf86ac4cc584", "lessThan": "3e8ec7c0387273329374f5c7bd61f5f38af71fe1", "versionType": "git"}], "programFiles": ["fs/verity/measure.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "0", "lessThan": "6.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/verity/measure.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1344b632cb5043e32939a84568125719111c5af3"}, {"url": "https://git.kernel.org/stable/c/2a5cfcad1d56e26d645b7887b0ed24c371851525"}, {"url": "https://git.kernel.org/stable/c/5bd63cad9df4328a184c409fbdad4f17944bcdb8"}, {"url": "https://git.kernel.org/stable/c/3e8ec7c0387273329374f5c7bd61f5f38af71fe1"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfsverity: Fix bpf_get_fsverity_digest() dynptr assumptions\n\nThe BPF verifier and the dynptr abstraction ensure that the memory space\nreferenced by a dynptr remains valid. They do not, however, provide any\nguarantee that the contents of the memory are stable. kfuncs are\nexpected to remain memory-safe even if concurrent modifications occur.\n\nbpf_get_fsverity_digest() didn't follow that: it could crash if\narg->digest_size was concurrently modified.\n\nFix that by using the known-good value hash_alg->digest_size instead.\n\nAlso widen 'dynptr_sz' and 'out_digest_sz' to u64 to match the return\ntype of __bpf_dynptr_size(). It doesn't appear that it can actually be\nmore than INT_MAX currently (since __bpf_dynptr_data_rw() excludes\nfile-based pointers), but the correct type might as well be used."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:17.568Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74590", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:05:59.372Z", "dateReserved": "2026-08-15T05:44:03.918Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:31:41.929Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/verity/measure.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1344b632cb5043e32939a84568125719111c5af3", "status": "affected", "version": "67814c00de3161181cddd06c77aeaf86ac4cc584", "versionType": "git"}, {"lessThan": "2a5cfcad1d56e26d645b7887b0ed24c371851525", "status": "affected", "version": "67814c00de3161181cddd06c77aeaf86ac4cc584", "versionType": "git"}, {"lessThan": "5bd63cad9df4328a184c409fbdad4f17944bcdb8", "status": "affected", "version": "67814c00de3161181cddd06c77aeaf86ac4cc584", "versionType": "git"}, {"lessThan": "3e8ec7c0387273329374f5c7bd61f5f38af71fe1", "status": "affected", "version": "67814c00de3161181cddd06c77aeaf86ac4cc584", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/verity/measure.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfsverity: Fix bpf_get_fsverity_digest() dynptr assumptions\n\nThe BPF verifier and the dynptr abstraction ensure that the memory space\nreferenced by a dynptr remains valid. They do not, however, provide any\nguarantee that the contents of the memory are stable. kfuncs are\nexpected to remain memory-safe even if concurrent modifications occur.\n\nbpf_get_fsverity_digest() didn't follow that: it could crash if\narg->digest_size was concurrently modified.\n\nFix that by using the known-good value hash_alg->digest_size instead.\n\nAlso widen 'dynptr_sz' and 'out_digest_sz' to u64 to match the return\ntype of __bpf_dynptr_size(). It doesn't appear that it can actually be\nmore than INT_MAX currently (since __bpf_dynptr_data_rw() excludes\nfile-based pointers), but the correct type might as well be used."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfsverity: Correcci\u00f3n de las suposiciones de dynptr en bpf_get_fsverity_digest()\n\nEl verificador BPF y la abstracci\u00f3n dynptr aseguran que el espacio de memoria referenciado por un dynptr permanezca v\u00e1lido. Sin embargo, no proporcionan ninguna garant\u00eda de que el contenido de la memoria sea estable. Se espera que las kfuncs permanezcan seguras para la memoria incluso si ocurren modificaciones concurrentes.\n\nbpf_get_fsverity_digest() no segu\u00eda eso: podr\u00eda fallar si arg -> digest_size era modificado concurrentemente.\n\nSolucione eso usando el valor conocido y correcto hash_alg -> digest_size en su lugar.\n\nTambi\u00e9n ampl\u00ede 'dynptr_sz' y 'out_digest_sz' a u64 para que coincida con el tipo de retorno de __bpf_dynptr_size(). No parece que actualmente pueda ser realmente m\u00e1s que INT_MAX (ya que __bpf_dynptr_data_rw() excluye los punteros basados en archivos), pero bien podr\u00eda usarse el tipo correcto."}], "id": "CVE-2026-74590", "lastModified": "2026-10-16T20:17:44.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74590", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:01:35.901397Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:31.243", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1344b632cb5043e32939a84568125719111c5af3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2a5cfcad1d56e26d645b7887b0ed24c371851525"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3e8ec7c0387273329374f5c7bd61f5f38af71fe1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5bd63cad9df4328a184c409fbdad4f17944bcdb8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions", "id": "2521454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521454"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-663", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfsverity: Fix bpf_get_fsverity_digest() dynptr assumptions\nThe BPF verifier and the dynptr abstraction ensure that the memory space\nreferenced by a dynptr remains valid. They do not, however, provide any\nguarantee that the contents of the memory are stable. kfuncs are\nexpected to remain memory-safe even if concurrent modifications occur.\nbpf_get_fsverity_digest() didn't follow that: it could crash if\narg->digest_size was concurrently modified.\nFix that by using the known-good value hash_alg->digest_size instead.\nAlso widen 'dynptr_sz' and 'out_digest_sz' to u64 to match the return\ntype of __bpf_dynptr_size(). It doesn't appear that it can actually be\nmore than INT_MAX currently (since __bpf_dynptr_data_rw() excludes\nfile-based pointers), but the correct type might as well be used.", "A flaw was found in the Linux kernel's `fsverity` subsystem. A local attacker could exploit a race condition in the `bpf_get_fsverity_digest()` function by concurrently modifying its `digest_size` argument. This could lead to a system crash, resulting in a denial of service."], "name": "CVE-2026-74590", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74590\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74590\nhttps://lore.kernel.org/linux-cve-announce/2026082212-CVE-2026-74590-5358@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[67814c00de3161181cddd06c77aeaf86ac4cc584,1344b632cb5043e32939a84568125719111c5af3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[67814c00de3161181cddd06c77aeaf86ac4cc584,2a5cfcad1d56e26d645b7887b0ed24c371851525)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[67814c00de3161181cddd06c77aeaf86ac4cc584,5bd63cad9df4328a184c409fbdad4f17944bcdb8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[67814c00de3161181cddd06c77aeaf86ac4cc584,3e8ec7c0387273329374f5c7bd61f5f38af71fe1)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T18:15:03.352788+00:00", "updated": "2026-08-25T19:00:08.060010+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}