CVE-2026-74662

inet: frags: publish queues before arming timer

Published Aug 22, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

inet: frags: publish queues before arming timer

inet_frag_create() arms the fragment queue timer before inserting the
queue into the fqdir rhashtable. If the namespace fragment timeout is
zero or negative, the timer can run before the queue is published.

The timer callback then marks the queue complete, tries to remove a node
that is not in the hash table yet, and drops the anticipated hash
reference. Creation can subsequently publish the completed queue without
restoring that reference, leaving a stale hash node after the caller drops
the remaining reference.

Publish the queue first and arm the timer while holding the queue lock.
This makes timer expiry wait until the queue is visible in the hash table,
so inet_frag_kill() can remove the node and balance the hash reference.

Analysis

Technical impact

The kernel’s inet fragment queue routine starts a timeout timer before adding the queue to the lookup hash table. If the fragment timeout is zero or negative, the timer can expire while the queue is still hidden. The callback then attempts to remove a node that is not yet present, dropping a reference that is never restored. This race can leave a stale hash entry, corrupt kernel memory, and cause a crash, resulting in a denial of service. The flaw stems from a race condition and improper removal logic, as reflected in CWE-367.

Affected Systems

All Linux kernel builds that include the inet fragment queue code are affected. No specific version range is listed, so the issue may exist in any kernel until the commit referenced in the advisory is merged.

Risk and Exploitability

Based on the description, it is inferred that delivering specially crafted fragmented IP traffic that triggers the faulty timer behavior is the likely attack vector, implying a network‑based attack vector. The EPSS score is less than 1%, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting low public exploitation activity. Nonetheless, the CVSS score of 9.8 indicates a critical severity, and the risk remains significant until a patch is applied.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`648700f76b03b7e8149d13cc2bdb3355035258a9`	affected	< f4e4dab62181b7fe7c011bed6fbef9fc3d48c769
`648700f76b03b7e8149d13cc2bdb3355035258a9`	affected	< 4ed0681dc2c1e0538b79d2fc56190ffcb369dacd
`648700f76b03b7e8149d13cc2bdb3355035258a9`	affected	< 08a04d7bfb9c103432561aff8a62b6872e694a6a
`648700f76b03b7e8149d13cc2bdb3355035258a9`	affected	< d3ffb89b2944672cf7bdd8e9ee577d2043b4a956
`648700f76b03b7e8149d13cc2bdb3355035258a9`	affected	< 39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0
`648700f76b03b7e8149d13cc2bdb3355035258a9`	affected	< 9f904dd3e455750e5d4ec9b2f134835811b85a2f
`648700f76b03b7e8149d13cc2bdb3355035258a9`	affected	< 928128865e43b197e30688dc1bc991592c97edcf
`648700f76b03b7e8149d13cc2bdb3355035258a9`	affected	< 653d7ddf6cba867777a3d14c4f83ace008c5ad13
`493107105843f299662b3b664a83804645564f12`	affected	—
`4.4.174`	affected	< 4.5

Linux

affected

Version	Status	Constraints
`4.17`	affected	—
`0`	unaffected	< 4.17
`5.10.267`	unaffected	≤ 5.10.*
`5.15.218`	unaffected	≤ 5.15.*
`6.1.185`	unaffected	≤ 6.1.*
`6.6.154`	unaffected	≤ 6.6.*
`6.12.106`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[648700f76b03b7e8149d13cc2bdb3355035258a9,9f904dd3e455750e5d4ec9b2f134835811b85a2f)`	affected	code_commit	—
`[648700f76b03b7e8149d13cc2bdb3355035258a9,928128865e43b197e30688dc1bc991592c97edcf)`	affected	code_commit	—
`[648700f76b03b7e8149d13cc2bdb3355035258a9,653d7ddf6cba867777a3d14c4f83ace008c5ad13)`	affected	code_commit	—
`493107105843f299662b3b664a83804645564f12`	affected	code_commit	—
`[4.4.174,4.5)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.17`	affected	generic	—
`[0,4.17)`	unaffected	generic	—
`[6.18.45,6.18.*]`	unaffected	generic	—
`[7.1.9,7.1.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the system to a Linux kernel version that contains the commit 9f904dd3e4..., which reorders the queue publication and timer arming.
If an immediate kernel upgrade is not possible, configure the fragment timeout setting so that it is positive (greater than zero) to prevent the timer from firing before the queue is visible.
As a temporary precaution, filter or limit fragmented IP traffic that could exercise the vulnerable code path until the patch is deployed.

Generated by OpenCVE AI on August 25, 2026 at 17:52 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Debian DSA	DSA-6477-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.514% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/08a04d7bfb9c103432561aff8a62b6872e694a6a
https://git.kernel.org/stable/c/39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0
https://git.kernel.org/stable/c/4ed0681dc2c1e0538b79d2fc56190ffcb369dacd
https://git.kernel.org/stable/c/653d7ddf6cba867777a3d14c4f83ace008c5ad13
https://git.kernel.org/stable/c/928128865e43b197e30688dc1bc991592c97edcf
https://git.kernel.org/stable/c/9f904dd3e455750e5d4ec9b2f134835811b85a2f
https://git.kernel.org/stable/c/d3ffb89b2944672cf7bdd8e9ee577d2043b4a956
https://git.kernel.org/stable/c/f4e4dab62181b7fe7c011bed6fbef9fc3d48c769
https://lore.kernel.org/linux-cve-announce/2026082228-CVE-2026-74662-bad3@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74662
https://www.cve.org/CVERecord?id=CVE-2026-74662

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 27, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/08a04d7bfb9c103432561aff8a62b6872e694a6a https://git.kernel.org/stable/c/39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0 https://git.kernel.org/stable/c/4ed0681dc2c1e0538b79d2fc56190ffcb369dacd https://git.kernel.org/stable/c/d3ffb89b2944672cf7bdd8e9ee577d2043b4a956 https://git.kernel.org/stable/c/f4e4dab62181b7fe7c011bed6fbef9fc3d48c769

Aug 25, 2026 3:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-362

Aug 25, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://lore.kernel.org/linux-cve-announce/2026082228-CVE-2026-74662-bad3@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74662 https://www.cve.org/CVERecord?id=CVE-2026-74662
Metrics	threat_severity `None`	threat_severity `Important`

Aug 25, 2026 6:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Aug 22, 2026 7:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362

Aug 22, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference.
Title		inet: frags: publish queues before arming timer
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/653d7ddf6cba867777a3d14c4f83ace008c5ad13 https://git.kernel.org/stable/c/928128865e43b197e30688dc1bc991592c97edcf https://git.kernel.org/stable/c/9f904dd3e455750e5d4ec9b2f134835811b85a2f