CVE-2026-74479 (GCVE-0-2026-74479)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-23 12:47
VLAI
Title
net: pktgen: fix proc entry use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix proc entry use-after-free pktgen_change_name() replaces pkt_dev->entry while holding t->if_lock. pktgen_remove_device() removes the same entry before _rem_dev_from_if_list() takes that lock. This allows the following interleaving: CPU 0 (NETDEV_CHANGENAME) CPU 1 (kpktgend) if_lock(t) proc_remove(pkt_dev->entry) proc_remove(pkt_dev->entry) pkt_dev->entry = proc_create_data(...) if_unlock(t) The kthread can pass the stale proc_dir_entry to proc_remove() after the rename path has freed it. A reproducer with a widened race window reports: BUG: KASAN: slab-use-after-free in proc_remove+0x78/0x80 Read of size 8 at addr ffff8881478fea70 by task kpktgend_0/67 Call Trace: proc_remove+0x78/0x80 pktgen_remove_device.isra.0+0x11c/0x4c0 pktgen_thread_worker+0x1214/0x6bc0 kthread+0x2c6/0x3b0 Allocated by task 95: __proc_create+0x204/0x790 proc_create_data+0x72/0xe0 pktgen_thread_write+0xd61/0x1510 Freed by task 28: kmem_cache_free+0xcb/0x3d0 proc_free_inode+0x5b/0x80 rcu_core+0x50a/0x1850 The buggy address belongs to the object at ffff8881478fea00 which belongs to the cache proc_dir_entry of size 192 Move proc_remove() into the if_lock-protected list removal helper. Keep it before list_del_rcu() to preserve the ordering required by add_device(). The rename path must then finish replacing the entry before removal, or it observes that the device is no longer on the list.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 39df232f1a9ba48d41c68ee7d4046756e709cf91 , < 82ed3db9269cb61e3c15bad2f6e221efce90e1e0 (git)
Affected: 39df232f1a9ba48d41c68ee7d4046756e709cf91 , < d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4 (git)
Affected: 39df232f1a9ba48d41c68ee7d4046756e709cf91 , < 7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4 (git)
Affected: 39df232f1a9ba48d41c68ee7d4046756e709cf91 , < 577443530cb592d5782a1f79847411a9363a65c8 (git)
Affected: 39df232f1a9ba48d41c68ee7d4046756e709cf91 , < f85a58340b91f225de3299dfa782c6414098077c (git)
Affected: 39df232f1a9ba48d41c68ee7d4046756e709cf91 , < 4ef801b838d85c0ea5852c50667f7344ce3b6cd0 (git)
Affected: 39df232f1a9ba48d41c68ee7d4046756e709cf91 , < b006a5404470bd3eb2aa0425fc447183032047ef (git)
Affected: 39df232f1a9ba48d41c68ee7d4046756e709cf91 , < 817ff6efdb7f484ea547218e11e17d8e43daa3b4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.22
Unaffected: 0 , < 2.6.22 (semver)
Unaffected: 5.10.266 , ≤ 5.10.* (semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.153 , ≤ 6.6.* (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/pktgen.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "82ed3db9269cb61e3c15bad2f6e221efce90e1e0",
              "status": "affected",
              "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
              "versionType": "git"
            },
            {
              "lessThan": "d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4",
              "status": "affected",
              "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
              "versionType": "git"
            },
            {
              "lessThan": "7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4",
              "status": "affected",
              "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
              "versionType": "git"
            },
            {
              "lessThan": "577443530cb592d5782a1f79847411a9363a65c8",
              "status": "affected",
              "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
              "versionType": "git"
            },
            {
              "lessThan": "f85a58340b91f225de3299dfa782c6414098077c",
              "status": "affected",
              "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
              "versionType": "git"
            },
            {
              "lessThan": "4ef801b838d85c0ea5852c50667f7344ce3b6cd0",
              "status": "affected",
              "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
              "versionType": "git"
            },
            {
              "lessThan": "b006a5404470bd3eb2aa0425fc447183032047ef",
              "status": "affected",
              "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
              "versionType": "git"
            },
            {
              "lessThan": "817ff6efdb7f484ea547218e11e17d8e43daa3b4",
              "status": "affected",
              "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/pktgen.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.22"
            },
            {
              "lessThan": "2.6.22",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pktgen: fix proc entry use-after-free\n\npktgen_change_name() replaces pkt_dev-\u003eentry while holding t-\u003eif_lock.\npktgen_remove_device() removes the same entry before\n_rem_dev_from_if_list() takes that lock.\n\nThis allows the following interleaving:\n\n  CPU 0 (NETDEV_CHANGENAME)       CPU 1 (kpktgend)\n  if_lock(t)\n  proc_remove(pkt_dev-\u003eentry)\n                                  proc_remove(pkt_dev-\u003eentry)\n  pkt_dev-\u003eentry = proc_create_data(...)\n  if_unlock(t)\n\nThe kthread can pass the stale proc_dir_entry to proc_remove() after the\nrename path has freed it. A reproducer with a widened race window reports:\n\n  BUG: KASAN: slab-use-after-free in proc_remove+0x78/0x80\n  Read of size 8 at addr ffff8881478fea70 by task kpktgend_0/67\n  Call Trace:\n   proc_remove+0x78/0x80\n   pktgen_remove_device.isra.0+0x11c/0x4c0\n   pktgen_thread_worker+0x1214/0x6bc0\n   kthread+0x2c6/0x3b0\n  Allocated by task 95:\n   __proc_create+0x204/0x790\n   proc_create_data+0x72/0xe0\n   pktgen_thread_write+0xd61/0x1510\n  Freed by task 28:\n   kmem_cache_free+0xcb/0x3d0\n   proc_free_inode+0x5b/0x80\n   rcu_core+0x50a/0x1850\n  The buggy address belongs to the object at ffff8881478fea00\n   which belongs to the cache proc_dir_entry of size 192\n\nMove proc_remove() into the if_lock-protected list removal helper. Keep it\nbefore list_del_rcu() to preserve the ordering required by add_device().\nThe rename path must then finish replacing the entry before removal, or\nit observes that the device is no longer on the list."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to /proc/net/pktgen procfs writes and a SIOCSIFNAME/ip-link rename of a pktgen-bound netdev; pktgen is configured only via local proc and ioctl paths, not via remote network packets.\nAC:L - The UAF is a race between pktgen_change_name() on NETDEV_CHANGENAME and pktgen_remove_device() in kpktgend; an attacker controls both sides concurrently via rem_device_all/unregister and interface rename, so success does not depend on uncontrollable timing.\nPR:L - Triggering rename needs ns_capable(CAP_NET_ADMIN) and pktgen proc writes are mode 0600; CAP_NET_ADMIN is obtainable by an unprivileged user via user/network namespaces (unshare -Urn), so real init-namespace root is not required.\nUI:N - No victim interaction is required; the attacker drives pktgen device add/remove and netdev rename/unregister directly through local proc writes and netlink/ioctl without needing another user to act.\nS:U - Impact is kernel slab corruption and potential privilege escalation within the same kernel security domain; it does not inherently cross VM, container, or IOMMU boundaries without additional unrelated primitives.\nC:H - The bug is a slab use-after-free of a proc_dir_entry in proc_remove(); KASAN shows reads of freed 192-byte objects, and UAF on proc metadata can be turned into arbitrary kernel memory disclosure via heap grooming.\nI:H - Corrupting or reusing the freed proc_dir_entry during proc_remove()/procfs teardown can enable attacker-controlled writes and control-flow hijack in kernel context, not merely a benign NULL dereference crash.\nA:H - Concurrent rename and removal causes proc_remove() to dereference a freed proc_dir_entry, producing KASAN slab-use-after-free and kernel oops/panic; even without full exploit development, the UAF reliably threatens system availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:23.408Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/82ed3db9269cb61e3c15bad2f6e221efce90e1e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4"
        },
        {
          "url": "https://git.kernel.org/stable/c/577443530cb592d5782a1f79847411a9363a65c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/f85a58340b91f225de3299dfa782c6414098077c"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ef801b838d85c0ea5852c50667f7344ce3b6cd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b006a5404470bd3eb2aa0425fc447183032047ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/817ff6efdb7f484ea547218e11e17d8e43daa3b4"
        }
      ],
      "title": "net: pktgen: fix proc entry use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74479",
    "datePublished": "2026-08-15T12:27:13.172Z",
    "dateReserved": "2026-08-15T05:44:03.904Z",
    "dateUpdated": "2026-08-23T12:47:23.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74479",
      "date": "2026-10-01",
      "epss": "0.00126",
      "percentile": "0.01942"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-23T02:54:44.000Z",
      "cve": "CVE-2026-74479",
      "id": "msrc_CVE-2026-74479",
      "initial_release_date": "2026-08-23T15:04:54.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: pktgen: fix proc entry use-after-free",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74479.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/core/pktgen.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "82ed3db9269cb61e3c15bad2f6e221efce90e1e0",
                    "status": "affected",
                    "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4",
                    "status": "affected",
                    "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4",
                    "status": "affected",
                    "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "577443530cb592d5782a1f79847411a9363a65c8",
                    "status": "affected",
                    "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f85a58340b91f225de3299dfa782c6414098077c",
                    "status": "affected",
                    "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4ef801b838d85c0ea5852c50667f7344ce3b6cd0",
                    "status": "affected",
                    "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b006a5404470bd3eb2aa0425fc447183032047ef",
                    "status": "affected",
                    "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "817ff6efdb7f484ea547218e11e17d8e43daa3b4",
                    "status": "affected",
                    "version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/core/pktgen.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.22"
                  },
                  {
                    "lessThan": "2.6.22",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.266",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.217",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.184",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.153",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.105",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pktgen: fix proc entry use-after-free\n\npktgen_change_name() replaces pkt_dev-\u003eentry while holding t-\u003eif_lock.\npktgen_remove_device() removes the same entry before\n_rem_dev_from_if_list() takes that lock.\n\nThis allows the following interleaving:\n\n  CPU 0 (NETDEV_CHANGENAME)       CPU 1 (kpktgend)\n  if_lock(t)\n  proc_remove(pkt_dev-\u003eentry)\n                                  proc_remove(pkt_dev-\u003eentry)\n  pkt_dev-\u003eentry = proc_create_data(...)\n  if_unlock(t)\n\nThe kthread can pass the stale proc_dir_entry to proc_remove() after the\nrename path has freed it. A reproducer with a widened race window reports:\n\n  BUG: KASAN: slab-use-after-free in proc_remove+0x78/0x80\n  Read of size 8 at addr ffff8881478fea70 by task kpktgend_0/67\n  Call Trace:\n   proc_remove+0x78/0x80\n   pktgen_remove_device.isra.0+0x11c/0x4c0\n   pktgen_thread_worker+0x1214/0x6bc0\n   kthread+0x2c6/0x3b0\n  Allocated by task 95:\n   __proc_create+0x204/0x790\n   proc_create_data+0x72/0xe0\n   pktgen_thread_write+0xd61/0x1510\n  Freed by task 28:\n   kmem_cache_free+0xcb/0x3d0\n   proc_free_inode+0x5b/0x80\n   rcu_core+0x50a/0x1850\n  The buggy address belongs to the object at ffff8881478fea00\n   which belongs to the cache proc_dir_entry of size 192\n\nMove proc_remove() into the if_lock-protected list removal helper. Keep it\nbefore list_del_rcu() to preserve the ordering required by add_device().\nThe rename path must then finish replacing the entry before removal, or\nit observes that the device is no longer on the list."
          }
        ],
        "id": "CVE-2026-74479",
        "lastModified": "2026-08-23T13:16:44.380",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:17:52.713",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4ef801b838d85c0ea5852c50667f7344ce3b6cd0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/577443530cb592d5782a1f79847411a9363a65c8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/817ff6efdb7f484ea547218e11e17d8e43daa3b4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/82ed3db9269cb61e3c15bad2f6e221efce90e1e0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b006a5404470bd3eb2aa0425fc447183032047ef"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f85a58340b91f225de3299dfa782c6414098077c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-21T08:23:37+00:00",
      "cve": "CVE-2026-74479",
      "id": "CVE-2026-74479",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: pktgen: fix proc entry use-after-free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74479.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-23T00:17:57Z",
      "cve": "CVE-2026-74479",
      "id": "CVE-2026-74479",
      "initial_release_date": "2026-08-15T23:52:07Z",
      "product_status:first_fixed": "68",
      "product_status:known_affected": "702",
      "product_status:recommended": "23",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74479",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74479.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.