CVE-2026-74490 - Vulnerability Details

- tipc: avoid use-after-free in poll trace queue dumps

Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: avoid use-after-free in poll trace queue dumps

TIPC socket tracepoints dump queue state through tipc_sk_dump(). Most
queue-dump callsites already serialize that walk under the socket lock or
sk->sk_lock.slock, but tipc_poll() calls trace_tipc_sk_poll(...,
TIPC_DUMP_ALL, ...) without holding either lock.

That lets the poll trace path reach tipc_list_dump() and backlog head/tail
dumping while another context dequeues and frees an skb, leaving the trace
helper dereferencing a stale queue entry.

Stop the unlocked poll trace site from requesting queue dumps. Other queue
dump trace callsites keep their existing output under the locking they
already provide, while poll still emits the event itself without walking
live queue members from an unlocked context.

Published: 2026-08-15

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s TIPC module has a use‑after‑free flaw in the poll trace path. When a poll operation triggers a trace that dumps the TIPC queue without holding the required socket lock, another context can concurrently dequeue and free a packet. The trace helper then dereferences a stale queue entry, corrupting kernel memory.

Affected Systems

All Linux kernel releases that include the unpatched tipc module. The fix was committed to the kernel repository; any kernel version prior to the commit that introduced the lock guard (see the provided Git links) is vulnerable. Systems running kernels that include the patch are not affected.

Risk and Exploitability

The flaw presents a high‑risk kernel memory corruption. The CVSS score is 8.8, while the EPSS score is < 1%. The vulnerability is not listed in KEV.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b4b9771bcbbd5839b0f77aba55e2f85989ed6779`	affected	< 3cd57c6b210d50fd1f7ac1720442ba5be5dc94f8
`b4b9771bcbbd5839b0f77aba55e2f85989ed6779`	affected	< ae7fc824970888b4fdaa076819c9a6f2fcede275
`b4b9771bcbbd5839b0f77aba55e2f85989ed6779`	affected	< 78706367fe1b98aee0a6de27c62b7f1e3035f38d
`b4b9771bcbbd5839b0f77aba55e2f85989ed6779`	affected	< d7940bb6a8e7ab28f972c2875cb05783216312dc
`b4b9771bcbbd5839b0f77aba55e2f85989ed6779`	affected	< 5e82beba4bc1f91d0e64c9c43f2b2fa9cd1c2a7d
`b4b9771bcbbd5839b0f77aba55e2f85989ed6779`	affected	< bed792737b5f1ba773054dbe984502958bdfe6ce
`b4b9771bcbbd5839b0f77aba55e2f85989ed6779`	affected	< ac2f787980fdf4364cd5651a4c8128e59b8de3aa
`b4b9771bcbbd5839b0f77aba55e2f85989ed6779`	affected	< b4f1719dfea023220e0e6bd892b087d76b2a6a49

Linux

affected

Version	Status	Constraints
`5.0`	affected	—
`0`	unaffected	< 5.0
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.151`	unaffected	≤ 6.6.*
`6.12.103`	unaffected	≤ 6.12.*
`6.18.44`	unaffected	≤ 6.18.*
`7.1.8`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[b4b9771bcbbd5839b0f77aba55e2f85989ed6779,d7940bb6a8e7ab28f972c2875cb05783216312dc)`	affected	code_commit	—
`[b4b9771bcbbd5839b0f77aba55e2f85989ed6779,5e82beba4bc1f91d0e64c9c43f2b2fa9cd1c2a7d)`	affected	code_commit	—
`[b4b9771bcbbd5839b0f77aba55e2f85989ed6779,bed792737b5f1ba773054dbe984502958bdfe6ce)`	affected	code_commit	—
`[b4b9771bcbbd5839b0f77aba55e2f85989ed6779,ac2f787980fdf4364cd5651a4c8128e59b8de3aa)`	affected	code_commit	—
`[b4b9771bcbbd5839b0f77aba55e2f85989ed6779,b4f1719dfea023220e0e6bd892b087d76b2a6a49)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.0`	affected	generic	—
`[0,5.0)`	unaffected	generic	—
`[6.6.151,6.7.0)`	unaffected	semver	—
`[6.12.103,6.13.0)`	unaffected	semver	—
`[6.18.44,6.19.0)`	unaffected	semver	—
`[7.1.8,7.2.0)`	unaffected	semver	—
`[7.2-rc6,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that includes the patch from commit 5e82beba4bc1f91d0e64c9c43f2b2fa9cd1c2a7d or later.
Disable the TIPC kernel module or TIPC socket tracing on systems that do not require it to reduce the attack surface.
If an immediate kernel update is not possible, apply a temporary local patch that adds a lock guard to the tipc_poll trace path to prevent the use‑after‑free.

Generated by OpenCVE AI on August 21, 2026 at 22:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00455.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3cd57c6b210d50fd1f7ac1720442ba5be5dc94f8
https://git.kernel.org/stable/c/5e82beba4bc1f91d0e64c9c43f2b2fa9cd1c2a7d
https://git.kernel.org/stable/c/78706367fe1b98aee0a6de27c62b7f1e3035f38d
https://git.kernel.org/stable/c/ac2f787980fdf4364cd5651a4c8128e59b8de3aa
https://git.kernel.org/stable/c/ae7fc824970888b4fdaa076819c9a6f2fcede275
https://git.kernel.org/stable/c/b4f1719dfea023220e0e6bd892b087d76b2a6a49
https://git.kernel.org/stable/c/bed792737b5f1ba773054dbe984502958bdfe6ce
https://git.kernel.org/stable/c/d7940bb6a8e7ab28f972c2875cb05783216312dc
https://lore.kernel.org/linux-cve-announce/2026081538-CVE-2026-74490-d5a0@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74490
https://www.cve.org/CVERecord?id=CVE-2026-74490

History

Fri, 21 Aug 2026 21:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Fri, 21 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026081538-CVE-2026-74490-d5a0@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74490 https://www.cve.org/CVERecord?id=CVE-2026-74490
Metrics	threat_severity `None`	threat_severity `Moderate`

Wed, 19 Aug 2026 17:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/3cd57c6b210d50fd1f7ac1720442ba5be5dc94f8 https://git.kernel.org/stable/c/78706367fe1b98aee0a6de27c62b7f1e3035f38d https://git.kernel.org/stable/c/ae7fc824970888b4fdaa076819c9a6f2fcede275

Mon, 17 Aug 2026 13:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Mon, 17 Aug 2026 11:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-787

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787

Sat, 15 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue state through tipc_sk_dump(). Most queue-dump callsites already serialize that walk under the socket lock or sk->sk_lock.slock, but tipc_poll() calls trace_tipc_sk_poll(..., TIPC_DUMP_ALL, ...) without holding either lock. That lets the poll trace path reach tipc_list_dump() and backlog head/tail dumping while another context dequeues and frees an skb, leaving the trace helper dereferencing a stale queue entry. Stop the unlocked poll trace site from requesting queue dumps. Other queue dump trace callsites keep their existing output under the locking they already provide, while poll still emits the event itself without walking live queue members from an unlocked context.
Title		tipc: avoid use-after-free in poll trace queue dumps
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5e82beba4bc1f91d0e64c9c43f2b2fa9cd1c2a7d https://git.kernel.org/stable/c/ac2f787980fdf4364cd5651a4c8128e59b8de3aa https://git.kernel.org/stable/c/b4f1719dfea023220e0e6bd892b087d76b2a6a49 https://git.kernel.org/stable/c/bed792737b5f1ba773054dbe984502958bdfe6ce https://git.kernel.org/stable/c/d7940bb6a8e7ab28f972c2875cb05783216312dc

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T12:27:20.107Z

Updated: 2026-08-19T16:37:45.610Z

Reserved: 2026-08-15T05:44:03.905Z

Link: CVE-2026-74490

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T13:17:53.917

Modified: 2026-08-19T17:21:06.030

Link: CVE-2026-74490

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74490 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-21T23:00:14Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object