CVE-2026-74596

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74596", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.919Z", "datePublished": "2026-08-22T15:31:46.383Z", "dateUpdated": "2026-10-21T12:46:01.695Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:46:01.695Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs,fsverity: remove check for fsverity being enabled in setattr_prepare()\n\nThe check that fs-verity is available in the kernel is not necessary\nhere. Filesystems could have fsverity files even without fs-verity\nenabled. In that case, truncate on fsverity file will succeed, what this\ncheck is trying to prevent."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/attr.c"], "versions": [{"version": "a4ca8102e70e10f8cfa63d922468d21500f3c090", "lessThan": "3f3b0898557a93122a7f941e6a89adef2bb29ce4", "status": "affected", "versionType": "git"}, {"version": "cc99c58f735bc55e6321f1f575ea218da91dcc4c", "lessThan": "fd4ed50c134fd9f2334b8b29d117f3af5fe250e9", "status": "affected", "versionType": "git"}, {"version": "2efdeec99ca09a9d638e1bcdc1a4afbfe3b4f2ec", "lessThan": "b4c0c41b952c21baed3f822eab508ebbd1d355d9", "status": "affected", "versionType": "git"}, {"version": "e9734653c523c744f03333ece6ae7a315187f05c", "lessThan": "2d2b2ed7bdcc6df4942292318c5455b5e94ba525", "status": "affected", "versionType": "git"}, {"version": "e9734653c523c744f03333ece6ae7a315187f05c", "lessThan": "d2f96bcb89d36d488a10e3bcf819b98536968286", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/attr.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3f3b0898557a93122a7f941e6a89adef2bb29ce4"}, {"url": "https://git.kernel.org/stable/c/fd4ed50c134fd9f2334b8b29d117f3af5fe250e9"}, {"url": "https://git.kernel.org/stable/c/b4c0c41b952c21baed3f822eab508ebbd1d355d9"}, {"url": "https://git.kernel.org/stable/c/2d2b2ed7bdcc6df4942292318c5455b5e94ba525"}, {"url": "https://git.kernel.org/stable/c/d2f96bcb89d36d488a10e3bcf819b98536968286"}], "title": "fs,fsverity: remove check for fsverity being enabled in setattr_prepare()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/attr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3f3b0898557a93122a7f941e6a89adef2bb29ce4", "status": "affected", "version": "a4ca8102e70e10f8cfa63d922468d21500f3c090", "versionType": "git"}, {"lessThan": "fd4ed50c134fd9f2334b8b29d117f3af5fe250e9", "status": "affected", "version": "cc99c58f735bc55e6321f1f575ea218da91dcc4c", "versionType": "git"}, {"lessThan": "b4c0c41b952c21baed3f822eab508ebbd1d355d9", "status": "affected", "version": "2efdeec99ca09a9d638e1bcdc1a4afbfe3b4f2ec", "versionType": "git"}, {"lessThan": "2d2b2ed7bdcc6df4942292318c5455b5e94ba525", "status": "affected", "version": "e9734653c523c744f03333ece6ae7a315187f05c", "versionType": "git"}, {"lessThan": "d2f96bcb89d36d488a10e3bcf819b98536968286", "status": "affected", "version": "e9734653c523c744f03333ece6ae7a315187f05c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/attr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs,fsverity: remove check for fsverity being enabled in setattr_prepare()\n\nThe check that fs-verity is available in the kernel is not necessary\nhere. Filesystems could have fsverity files even without fs-verity\nenabled. In that case, truncate on fsverity file will succeed, what this\ncheck is trying to prevent."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfs,fsverity: eliminar la comprobaci\u00f3n de que fsverity est\u00e9 habilitado en setattr_prepare()\n\nLa comprobaci\u00f3n de que fs-verity est\u00e1 disponible en el kernel no es necesaria aqu\u00ed. Los sistemas de archivos podr\u00edan tener archivos fsverity incluso sin fs-verity habilitado. En ese caso, la truncaci\u00f3n en el archivo fsverity tendr\u00e1 \u00e9xito, lo que esta comprobaci\u00f3n est\u00e1 tratando de evitar."}], "id": "CVE-2026-74596", "lastModified": "2026-10-21T13:19:47.673", "metrics": {}, "published": "2026-08-22T16:16:31.923", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2d2b2ed7bdcc6df4942292318c5455b5e94ba525"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3f3b0898557a93122a7f941e6a89adef2bb29ce4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b4c0c41b952c21baed3f822eab508ebbd1d355d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d2f96bcb89d36d488a10e3bcf819b98536968286"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fd4ed50c134fd9f2334b8b29d117f3af5fe250e9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: fs,fsverity: remove check for fsverity being enabled in setattr_prepare()", "id": "2521437", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521437"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-253", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfs,fsverity: remove check for fsverity being enabled in setattr_prepare()\nThe check that fs-verity is available in the kernel is not necessary\nhere. Filesystems could have fsverity files even without fs-verity\nenabled. In that case, truncate on fsverity file will succeed, what this\ncheck is trying to prevent.", "A flaw was found in the Linux kernel's fsverity subsystem. The vulnerability is due to the removal of a check in the setattr_prepare() function, which previously verified if fs-verity was enabled. This change allows fsverity files to be truncated even when the fs-verity feature is not active on the filesystem. This could lead to unintended modifications of fsverity protected files, potentially impacting data integrity."], "name": "CVE-2026-74596", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74596\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74596\nhttps://lore.kernel.org/linux-cve-announce/2026082214-CVE-2026-74596-8356@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e9734653c523c744f03333ece6ae7a315187f05c,2d2b2ed7bdcc6df4942292318c5455b5e94ba525)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e9734653c523c744f03333ece6ae7a315187f05c,d2f96bcb89d36d488a10e3bcf819b98536968286)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T16:30:05.475321+00:00", "updated": "2026-08-25T14:00:17.986791+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}