CVE-2026-74286 - Vulnerability Details

- net: pfcp: allocate per-cpu tstats for PFCP netdevs

Description

In the Linux kernel, the following vulnerability has been resolved:

net: pfcp: allocate per-cpu tstats for PFCP netdevs

PFCP uses dev_get_tstats64() as its ndo_get_stats64 callback, but
pfcp_link_setup() does not request NETDEV_PCPU_STAT_TSTATS. The net
core therefore leaves dev->tstats NULL for PFCP devices.

Creating a PFCP rtnetlink device can immediately ask the new netdev for
stats while building the RTM_NEWLINK notification. That reaches
dev_get_tstats64() and dereferences the NULL dev->tstats pointer.

Set pcpu_stat_type to NETDEV_PCPU_STAT_TSTATS during PFCP link setup so
the net core allocates the storage expected by dev_get_tstats64().

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The PFCP network device driver contains a null pointer dereference that occurs when the statistics callback dev_get_tstats64() is called on a PFCP netdevice that has not been initialized with a tstats structure. The missing allocation results in the kernel dereferencing a null pointer, causing a crash and a loss of system availability.

Affected Systems

All Linux kernel releases that include the PFCP driver but lack the commit that allocates per‑CPU tstats for PFCP netdevs are affected. Users running those kernel versions on any distribution that ships the PFCP netdev interface are at risk.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate severity. The EPSS score is reported as < 1%, implying a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to create or query PFCP netdevices, which typically requires local or privileged access to the system. Once exercised, the kernel crashes, disrupting availability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`76c8764ef36a5d37ea2e551bda28ac7f028383ba`	affected	< 56b4ad500fd1282ef04db3c4beae5b54ab093a53
`76c8764ef36a5d37ea2e551bda28ac7f028383ba`	affected	< 51a1d9836acc76a1bd16170b2f4b35f11036593f
`76c8764ef36a5d37ea2e551bda28ac7f028383ba`	affected	< 67e4b283de36d9eebf95acdea5d6674b6ef4b2f4
`76c8764ef36a5d37ea2e551bda28ac7f028383ba`	affected	< 24041543da8cd84eb5d8ae738c534372fff54820

Linux

affected

Version	Status	Constraints
`6.10`	affected	—
`0`	unaffected	< 6.10
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[76c8764ef36a5d37ea2e551bda28ac7f028383ba,56b4ad500fd1282ef04db3c4beae5b54ab093a53)`	affected	code_commit	—
`[76c8764ef36a5d37ea2e551bda28ac7f028383ba,51a1d9836acc76a1bd16170b2f4b35f11036593f)`	affected	code_commit	—
`[76c8764ef36a5d37ea2e551bda28ac7f028383ba,67e4b283de36d9eebf95acdea5d6674b6ef4b2f4)`	affected	code_commit	—
`[76c8764ef36a5d37ea2e551bda28ac7f028383ba,24041543da8cd84eb5d8ae738c534372fff54820)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.10`	affected	generic	—
`[0,6.10)`	unaffected	generic	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that allocates per‑CPU tstats for PFCP netdevs (commit 24041543…).
Deploy an updated kernel built with the commit to the affected systems.
Restart the system so that the patched kernel is active.

Generated by OpenCVE AI on August 22, 2026 at 02:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/24041543da8cd84eb5d8ae738c534372fff54820
https://git.kernel.org/stable/c/51a1d9836acc76a1bd16170b2f4b35f11036593f
https://git.kernel.org/stable/c/56b4ad500fd1282ef04db3c4beae5b54ab093a53
https://git.kernel.org/stable/c/67e4b283de36d9eebf95acdea5d6674b6ef4b2f4
https://lore.kernel.org/linux-cve-announce/2026081547-CVE-2026-74286-08f8@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74286
https://www.cve.org/CVERecord?id=CVE-2026-74286

History

Fri, 21 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081547-CVE-2026-74286-08f8@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74286 https://www.cve.org/CVERecord?id=CVE-2026-74286
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 15 Aug 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sat, 15 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses dev_get_tstats64() as its ndo_get_stats64 callback, but pfcp_link_setup() does not request NETDEV_PCPU_STAT_TSTATS. The net core therefore leaves dev->tstats NULL for PFCP devices. Creating a PFCP rtnetlink device can immediately ask the new netdev for stats while building the RTM_NEWLINK notification. That reaches dev_get_tstats64() and dereferences the NULL dev->tstats pointer. Set pcpu_stat_type to NETDEV_PCPU_STAT_TSTATS during PFCP link setup so the net core allocates the storage expected by dev_get_tstats64().
Title		net: pfcp: allocate per-cpu tstats for PFCP netdevs
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/24041543da8cd84eb5d8ae738c534372fff54820 https://git.kernel.org/stable/c/51a1d9836acc76a1bd16170b2f4b35f11036593f https://git.kernel.org/stable/c/56b4ad500fd1282ef04db3c4beae5b54ab093a53 https://git.kernel.org/stable/c/67e4b283de36d9eebf95acdea5d6674b6ef4b2f4

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:57:54.529Z

Updated: 2026-08-17T05:16:32.000Z

Reserved: 2026-08-15T05:44:03.881Z

Link: CVE-2026-74286

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:28.127

Modified: 2026-08-17T06:19:22.497

Link: CVE-2026-74286

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74286 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T02:15:03Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object