CVE-2026-74689

In the Linux kernel, a flaw in vcc_setsockopt() caused an ineffective length check on the socket option value. When the option name or protocol level did not match, the check was bypassed, and the kernel performed a memory copy that assumed a larger buffer than actually supplied. The result was a slab‑out‑of‑bounds read that could expose kernel memory contents. While the vulnerability does not directly grant code execution, read access to the kernel may disclose privileged secrets and create a pivot for further exploitation.

All Linux kernel builds containing the unpatched atm driver are affected. No specific kernel version range is provided; the fix was merged into the mainline tree and applies to subsequent releases.

The exploit requires local kernel access; an attacker can influence the ATM socket through setsockopt in a user or BPF context, possibly truncating the buffer. The EPSS score is <1%, and the CVE is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation. The CVSS score of 7.1 indicates a high risk for information disclosure. Still, attackers who manage to trigger the out‑of‑bounds read can obtain kernel memory data, and because the vulnerability occurs in privileged kernel code, it could be a stepping stone for privilege escalation.