CVE-2026-74614

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74614", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.920Z", "datePublished": "2026-08-22T15:31:59.800Z", "dateUpdated": "2026-10-16T19:06:01.847Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:40.984Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: read virtqueues under worker locks\n\nCommit bd50c5dc182b (\"vsock/virtio: add support for device\nsuspend/resume\") made the *_run flags transition from false to true when\nrestore installs replacement virtqueues. The RX, TX and event workers\nread their virtqueue before locking and checking the corresponding flag,\nso a worker delayed across freeze and restore can observe the replacement\nqueue's running state while retaining a pointer to the deleted queue.\n\nRead each virtqueue under its mutex after checking the run flag, keeping\nthe pointer and state in the same queue generation."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in the guest virtio-vsock driver reached via AF_VSOCK sockets and virtio virtqueue completions, not via routable network protocols; per kernel CNA guidance vsock and virtio guest-driver bugs are scored Local even when the hypervisor is the peer.\nAC:L - An attacker or malicious host controls both sides of the race by flooding vsock/virtqueue traffic to queue RX/TX/event workers while virtio_vsock_freeze/restore deletes and replaces virtqueues, making the stale pre-lock virtqueue pointer race reliable and repeatable.\nPR:N - No guest privileges are required in the highest-impact scenario: a malicious hypervisor or host-initiated suspend/migrate triggers freeze/restore while virtio completions queue workers, matching confidential-computing models where the host is untrusted and holds no guest credentials.\nUI:N - Vulnerable RX/TX/event workers run automatically from virtqueue IRQ callbacks on a dedicated workqueue; no victim must mount filesystems, open files, or take deliberate action beyond normal virtio-vsock device operation and VM lifecycle events.\nS:U - Corruption is confined to the guest kernel virtio-vsock driver; exploited impact stays within the guest security boundary and does not cross to the hypervisor (guest-to-host escape would involve vhost-vsock on the host, not this guest-side driver).\nC:H - Use-after-free of a deleted virtqueue: virtqueue_disable_cb, virtqueue_get_buf, and virtqueue_enable_cb dereference freed vring_virtqueue slab memory, enabling attacker-controlled reuse and arbitrary kernel memory disclosure typical of virtio UAF bugs.\nI:H - Corrupted virtqueue metadata permits out-of-bounds ring/index manipulation and further virtqueue operations, furnishing heap corruption and arbitrary-write primitives suitable for guest ring-0 code execution and privilege escalation.\nA:H - Operating on freed virtqueues triggers KASAN slab-use-after-free and kernel BUG/oops/panic (as in the related virtio-vsock freeze bug CVE-2026-74613), fully denying guest availability even when full exploitation is not attempted."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/vmw_vsock/virtio_transport.c"], "versions": [{"version": "762c251c7f5c4ee5bef71460c6e822ed293fd69f", "lessThan": "941329ce14c5f481223a10d1d4c8b57ea7f3048a", "status": "affected", "versionType": "git"}, {"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "29dd10583bf9d2744cd84b862e4257c0a5699570", "status": "affected", "versionType": "git"}, {"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "a1fb0c5b8a7c2753758aeced40971f99449dde0c", "status": "affected", "versionType": "git"}, {"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "eae099c764c7ebdb842eb1f638913e310bdd6513", "status": "affected", "versionType": "git"}, {"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "bd43a7ec668be428265b3209eb43647aedcf720a", "status": "affected", "versionType": "git"}, {"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "1cecb4202afdbeddcf29d59baf596ac6ab753f7f", "status": "affected", "versionType": "git"}, {"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "ebac8f6b1ef0e9278afe204b8692a7479988dace", "status": "affected", "versionType": "git"}, {"version": "5.15.138", "lessThan": "5.15.216", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/vmw_vsock/virtio_transport.c"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.138", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/941329ce14c5f481223a10d1d4c8b57ea7f3048a"}, {"url": "https://git.kernel.org/stable/c/29dd10583bf9d2744cd84b862e4257c0a5699570"}, {"url": "https://git.kernel.org/stable/c/a1fb0c5b8a7c2753758aeced40971f99449dde0c"}, {"url": "https://git.kernel.org/stable/c/eae099c764c7ebdb842eb1f638913e310bdd6513"}, {"url": "https://git.kernel.org/stable/c/bd43a7ec668be428265b3209eb43647aedcf720a"}, {"url": "https://git.kernel.org/stable/c/1cecb4202afdbeddcf29d59baf596ac6ab753f7f"}, {"url": "https://git.kernel.org/stable/c/ebac8f6b1ef0e9278afe204b8692a7479988dace"}], "title": "vsock/virtio: read virtqueues under worker locks", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74614", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:02:27.223007Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:06:01.847Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74614", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:02:27.223007Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:02:27.799Z"}}], "cna": {"title": "vsock/virtio: read virtqueues under worker locks", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in the guest virtio-vsock driver reached via AF_VSOCK sockets and virtio virtqueue completions, not via routable network protocols; per kernel CNA guidance vsock and virtio guest-driver bugs are scored Local even when the hypervisor is the peer.\nAC:L - An attacker or malicious host controls both sides of the race by flooding vsock/virtqueue traffic to queue RX/TX/event workers while virtio_vsock_freeze/restore deletes and replaces virtqueues, making the stale pre-lock virtqueue pointer race reliable and repeatable.\nPR:N - No guest privileges are required in the highest-impact scenario: a malicious hypervisor or host-initiated suspend/migrate triggers freeze/restore while virtio completions queue workers, matching confidential-computing models where the host is untrusted and holds no guest credentials.\nUI:N - Vulnerable RX/TX/event workers run automatically from virtqueue IRQ callbacks on a dedicated workqueue; no victim must mount filesystems, open files, or take deliberate action beyond normal virtio-vsock device operation and VM lifecycle events.\nS:U - Corruption is confined to the guest kernel virtio-vsock driver; exploited impact stays within the guest security boundary and does not cross to the hypervisor (guest-to-host escape would involve vhost-vsock on the host, not this guest-side driver).\nC:H - Use-after-free of a deleted virtqueue: virtqueue_disable_cb, virtqueue_get_buf, and virtqueue_enable_cb dereference freed vring_virtqueue slab memory, enabling attacker-controlled reuse and arbitrary kernel memory disclosure typical of virtio UAF bugs.\nI:H - Corrupted virtqueue metadata permits out-of-bounds ring/index manipulation and further virtqueue operations, furnishing heap corruption and arbitrary-write primitives suitable for guest ring-0 code execution and privilege escalation.\nA:H - Operating on freed virtqueues triggers KASAN slab-use-after-free and kernel BUG/oops/panic (as in the related virtio-vsock freeze bug CVE-2026-74613), fully denying guest availability even when full exploitation is not attempted."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "762c251c7f5c4ee5bef71460c6e822ed293fd69f", "lessThan": "941329ce14c5f481223a10d1d4c8b57ea7f3048a", "versionType": "git"}, {"status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "29dd10583bf9d2744cd84b862e4257c0a5699570", "versionType": "git"}, {"status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "a1fb0c5b8a7c2753758aeced40971f99449dde0c", "versionType": "git"}, {"status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "eae099c764c7ebdb842eb1f638913e310bdd6513", "versionType": "git"}, {"status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "bd43a7ec668be428265b3209eb43647aedcf720a", "versionType": "git"}, {"status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "1cecb4202afdbeddcf29d59baf596ac6ab753f7f", "versionType": "git"}, {"status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "ebac8f6b1ef0e9278afe204b8692a7479988dace", "versionType": "git"}, {"status": "affected", "version": "5.15.138", "lessThan": "5.15.216", "versionType": "semver"}], "programFiles": ["net/vmw_vsock/virtio_transport.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"status": "unaffected", "version": "0", "lessThan": "5.19", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/vmw_vsock/virtio_transport.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/941329ce14c5f481223a10d1d4c8b57ea7f3048a"}, {"url": "https://git.kernel.org/stable/c/29dd10583bf9d2744cd84b862e4257c0a5699570"}, {"url": "https://git.kernel.org/stable/c/a1fb0c5b8a7c2753758aeced40971f99449dde0c"}, {"url": "https://git.kernel.org/stable/c/eae099c764c7ebdb842eb1f638913e310bdd6513"}, {"url": "https://git.kernel.org/stable/c/bd43a7ec668be428265b3209eb43647aedcf720a"}, {"url": "https://git.kernel.org/stable/c/1cecb4202afdbeddcf29d59baf596ac6ab753f7f"}, {"url": "https://git.kernel.org/stable/c/ebac8f6b1ef0e9278afe204b8692a7479988dace"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: read virtqueues under worker locks\n\nCommit bd50c5dc182b (\"vsock/virtio: add support for device\nsuspend/resume\") made the *_run flags transition from false to true when\nrestore installs replacement virtqueues. The RX, TX and event workers\nread their virtqueue before locking and checking the corresponding flag,\nso a worker delayed across freeze and restore can observe the replacement\nqueue's running state while retaining a pointer to the deleted queue.\n\nRead each virtqueue under its mutex after checking the run flag, keeping\nthe pointer and state in the same queue generation."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "5.15.138"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "5.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.152", "versionStartIncluding": "5.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "5.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "5.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "5.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.19"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:40.984Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74614", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:06:01.847Z", "dateReserved": "2026-08-15T05:44:03.920Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:31:59.800Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/vmw_vsock/virtio_transport.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "941329ce14c5f481223a10d1d4c8b57ea7f3048a", "status": "affected", "version": "762c251c7f5c4ee5bef71460c6e822ed293fd69f", "versionType": "git"}, {"lessThan": "29dd10583bf9d2744cd84b862e4257c0a5699570", "status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "versionType": "git"}, {"lessThan": "a1fb0c5b8a7c2753758aeced40971f99449dde0c", "status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "versionType": "git"}, {"lessThan": "eae099c764c7ebdb842eb1f638913e310bdd6513", "status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "versionType": "git"}, {"lessThan": "bd43a7ec668be428265b3209eb43647aedcf720a", "status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "versionType": "git"}, {"lessThan": "1cecb4202afdbeddcf29d59baf596ac6ab753f7f", "status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "versionType": "git"}, {"lessThan": "ebac8f6b1ef0e9278afe204b8692a7479988dace", "status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "versionType": "git"}, {"lessThan": "5.15.216", "status": "affected", "version": "5.15.138", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/vmw_vsock/virtio_transport.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: read virtqueues under worker locks\n\nCommit bd50c5dc182b (\"vsock/virtio: add support for device\nsuspend/resume\") made the *_run flags transition from false to true when\nrestore installs replacement virtqueues. The RX, TX and event workers\nread their virtqueue before locking and checking the corresponding flag,\nso a worker delayed across freeze and restore can observe the replacement\nqueue's running state while retaining a pointer to the deleted queue.\n\nRead each virtqueue under its mutex after checking the run flag, keeping\nthe pointer and state in the same queue generation."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nvsock/virtio: leer virtqueues bajo bloqueos de trabajador\n\nEl commit bd50c5dc182b ('vsock/virtio: a\u00f1adir soporte para suspensi\u00f3n/reanudaci\u00f3n de dispositivo') hizo que las banderas *_run transicionaran de falso a verdadero cuando la restauraci\u00f3n instala virtqueues de reemplazo. Los trabajadores de RX, TX y eventos leen su virtqueue antes de bloquear y verificar la bandera correspondiente, por lo que un trabajador retrasado a trav\u00e9s de la congelaci\u00f3n y restauraci\u00f3n puede observar el estado de ejecuci\u00f3n de la cola de reemplazo mientras retiene un puntero a la cola eliminada.\n\nLeer cada virtqueue bajo su mutex despu\u00e9s de verificar la bandera de ejecuci\u00f3n, manteniendo el puntero y el estado en la misma generaci\u00f3n de cola."}], "id": "CVE-2026-74614", "lastModified": "2026-10-16T20:17:46.687", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74614", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:02:27.223007Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:34.023", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1cecb4202afdbeddcf29d59baf596ac6ab753f7f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/29dd10583bf9d2744cd84b862e4257c0a5699570"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/941329ce14c5f481223a10d1d4c8b57ea7f3048a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a1fb0c5b8a7c2753758aeced40971f99449dde0c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bd43a7ec668be428265b3209eb43647aedcf720a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eae099c764c7ebdb842eb1f638913e310bdd6513"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ebac8f6b1ef0e9278afe204b8692a7479988dace"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: vsock/virtio: read virtqueues under worker locks", "id": "2521402", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521402"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-820", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvsock/virtio: read virtqueues under worker locks\nCommit bd50c5dc182b (\"vsock/virtio: add support for device\nsuspend/resume\") made the *_run flags transition from false to true when\nrestore installs replacement virtqueues. The RX, TX and event workers\nread their virtqueue before locking and checking the corresponding flag,\nso a worker delayed across freeze and restore can observe the replacement\nqueue's running state while retaining a pointer to the deleted queue.\nRead each virtqueue under its mutex after checking the run flag, keeping\nthe pointer and state in the same queue generation.", "A flaw was found in the Linux kernel's `vsock/virtio` component. During system suspend and resume operations, a worker process might incorrectly retain a pointer to a deleted virtual queue while observing a replacement queue's running state. This inconsistent state can lead to system instability or a denial of service."], "name": "CVE-2026-74614", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74614\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74614\nhttps://lore.kernel.org/linux-cve-announce/2026082218-CVE-2026-74614-b5a1@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[762c251c7f5c4ee5bef71460c6e822ed293fd69f,941329ce14c5f481223a10d1d4c8b57ea7f3048a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c,29dd10583bf9d2744cd84b862e4257c0a5699570)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c,a1fb0c5b8a7c2753758aeced40971f99449dde0c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c,eae099c764c7ebdb842eb1f638913e310bdd6513)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c,bd43a7ec668be428265b3209eb43647aedcf720a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c,1cecb4202afdbeddcf29d59baf596ac6ab753f7f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c,ebac8f6b1ef0e9278afe204b8692a7479988dace)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.138,5.15.216)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.216,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.183,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.152,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.104,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.45,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.9,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T18:00:04.527470+00:00", "updated": "2026-08-25T16:15:05.599834+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}