CVE-2026-74749

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74749", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.931Z", "datePublished": "2026-08-26T14:36:57.763Z", "dateUpdated": "2026-08-26T14:36:57.763Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-26T14:36:57.763Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrseq: Prevent hard lockup on granted time slice extension\n\n__exit_to_user_mode_loop() invokes rseq_grant_timeslice_extension() with\ninterrupts enabled. If the extension is granted it invokes\nhrtimer_rearm_deferred_tif() to ensure that a pending deferred hrtimer\nrearm is handled before exiting to user space.\n\nThough this invokes __hrtimer_rearm_deferred() which expects to be invoked\nwith interrupts disabled as it takes hrtimer_cpu_base::lock with\nraw_spin_lock(). That's a livelock waiting to happen and caught by lockdep:\n\n WARNING: ./include/linux/hrtimer_rearm.h:17 at irqentry_exit, CPU#1: slice_test\n WARNING: inconsistent lock state\n inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.\n\nPrevent this by disabling interrupts around the invocation of\nhrtimer_rearm_deferred_tif() in rseq_grant_timeslice_extension().\n\n[ tglx: Massaged change log ]"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/rseq_entry.h"], "versions": [{"version": "15dd3a9488557d3e6ebcecacab79f4e56b69ab54", "lessThan": "8bbf4405050bc4f98be68082a20efa081ea8ad9b", "status": "affected", "versionType": "git"}, {"version": "15dd3a9488557d3e6ebcecacab79f4e56b69ab54", "lessThan": "ada54c2ba652348c590d1ace6a2f4ff77cbbf809", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/rseq_entry.h"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.1.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8bbf4405050bc4f98be68082a20efa081ea8ad9b"}, {"url": "https://git.kernel.org/stable/c/ada54c2ba652348c590d1ace6a2f4ff77cbbf809"}], "title": "rseq: Prevent hard lockup on granted time slice extension", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/rseq_entry.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8bbf4405050bc4f98be68082a20efa081ea8ad9b", "status": "affected", "version": "15dd3a9488557d3e6ebcecacab79f4e56b69ab54", "versionType": "git"}, {"lessThan": "ada54c2ba652348c590d1ace6a2f4ff77cbbf809", "status": "affected", "version": "15dd3a9488557d3e6ebcecacab79f4e56b69ab54", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/rseq_entry.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrseq: Prevent hard lockup on granted time slice extension\n\n__exit_to_user_mode_loop() invokes rseq_grant_timeslice_extension() with\ninterrupts enabled. If the extension is granted it invokes\nhrtimer_rearm_deferred_tif() to ensure that a pending deferred hrtimer\nrearm is handled before exiting to user space.\n\nThough this invokes __hrtimer_rearm_deferred() which expects to be invoked\nwith interrupts disabled as it takes hrtimer_cpu_base::lock with\nraw_spin_lock(). That's a livelock waiting to happen and caught by lockdep:\n\n WARNING: ./include/linux/hrtimer_rearm.h:17 at irqentry_exit, CPU#1: slice_test\n WARNING: inconsistent lock state\n inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.\n\nPrevent this by disabling interrupts around the invocation of\nhrtimer_rearm_deferred_tif() in rseq_grant_timeslice_extension().\n\n[ tglx: Massaged change log ]"}], "id": "CVE-2026-74749", "lastModified": "2026-08-26T15:16:53.933", "metrics": {}, "published": "2026-08-26T15:16:53.933", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8bbf4405050bc4f98be68082a20efa081ea8ad9b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ada54c2ba652348c590d1ace6a2f4ff77cbbf809"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: rseq: Prevent hard lockup on granted time slice extension", "id": "2524421", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524421"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-366", "details": ["A flaw was found in the Linux kernel's restartable sequences (rseq) mechanism. An inconsistency in the handling of lock states during time slice extensions can occur when interrupts are enabled. This can lead to a system livelock or hard lockup, effectively causing a Denial of Service (DoS) for the affected system."], "name": "CVE-2026-74749", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74749\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74749\nhttps://lore.kernel.org/linux-cve-announce/2026082659-CVE-2026-74749-2cf1@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15dd3a9488557d3e6ebcecacab79f4e56b69ab54,8bbf4405050bc4f98be68082a20efa081ea8ad9b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15dd3a9488557d3e6ebcecacab79f4e56b69ab54,ada54c2ba652348c590d1ace6a2f4ff77cbbf809)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.10,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-26T16:00:07.216843+00:00", "updated": "2026-08-27T04:00:13.985432+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}