CVE-2026-74563 (GCVE-0-2026-74563)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:28 – Updated: 2026-08-19 16:39
VLAI
EPSS
VEX
Title
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
Summary
In the Linux kernel, the following vulnerability has been resolved:
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
rds_tcp_laddr_check() looks up a scoped IPv6 interface with
dev_get_by_index_rcu(), drops the RCU read-side lock, and only then
passes the bare struct net_device * into ipv6_chk_addr().
dev_get_by_index_rcu() only keeps the device alive within the same RCU
read-side section. After rcu_read_unlock(), a concurrent RTM_DELLINK can
free the net_device; ipv6_chk_addr() then dereferences the stale pointer
in __ipv6_chk_addr_and_flags() (e.g. l3mdev_master_dev_rcu(dev)), reading
freed memory.
Keep the RCU read-side lock held across the ipv6_chk_addr() call instead
of dropping it right after the lookup, so the device cannot be freed
while it is in use.
BUG: KASAN: slab-use-after-free in __ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998)
Read of size 8 at addr ffff8880106ec000 by task exploit/153
Call Trace:
...
kasan_report (mm/kasan/report.c:595)
__ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998)
ipv6_chk_addr (net/ipv6/addrconf.c:2031 net/ipv6/addrconf.c:1972)
rds_tcp_laddr_check (net/rds/tcp.c:370)
rds_bind (net/rds/bind.c:248)
__sys_bind (net/socket.c:1920)
__x64_sys_bind (net/socket.c:1956)
do_syscall_64 (arch/x86/entry/syscall_64.c:63)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 , < f8a8977af2134a1d91e5f9773cb7d9d53278c830
(git)
Affected: eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 , < ba95bce5dfe6e2ef602a87e0557225f2934ccb5c (git) Affected: eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 , < c4933624a6f416ecfcc31ab58d585da1207a0597 (git) Affected: eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 , < 76dd48886eeeb5fcf2b837d2f4c3d17eebeac9ef (git) Affected: eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 , < f0d1fb05d70c8a561cd8d0473bcacafa2fc137ff (git) Affected: eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 , < b1d480fce05f857dc438080cd8c9244b84a83494 (git) Affected: eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 , < 8398bc477d3cb3e2b018a5aaac2bec0f69acda30 (git) Affected: eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 , < 78f75d632f74b8de0f081a128588f7c37d0d1164 (git) |
guessed | |
| Linux | Linux |
Affected:
4.19
Unaffected: 0 , < 4.19 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f8a8977af2134a1d91e5f9773cb7d9d53278c830",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "ba95bce5dfe6e2ef602a87e0557225f2934ccb5c",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "c4933624a6f416ecfcc31ab58d585da1207a0597",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "76dd48886eeeb5fcf2b837d2f4c3d17eebeac9ef",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "f0d1fb05d70c8a561cd8d0473bcacafa2fc137ff",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "b1d480fce05f857dc438080cd8c9244b84a83494",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "8398bc477d3cb3e2b018a5aaac2bec0f69acda30",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "78f75d632f74b8de0f081a128588f7c37d0d1164",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()\n\nrds_tcp_laddr_check() looks up a scoped IPv6 interface with\ndev_get_by_index_rcu(), drops the RCU read-side lock, and only then\npasses the bare struct net_device * into ipv6_chk_addr().\n\ndev_get_by_index_rcu() only keeps the device alive within the same RCU\nread-side section. After rcu_read_unlock(), a concurrent RTM_DELLINK can\nfree the net_device; ipv6_chk_addr() then dereferences the stale pointer\nin __ipv6_chk_addr_and_flags() (e.g. l3mdev_master_dev_rcu(dev)), reading\nfreed memory.\n\nKeep the RCU read-side lock held across the ipv6_chk_addr() call instead\nof dropping it right after the lookup, so the device cannot be freed\nwhile it is in use.\n\n BUG: KASAN: slab-use-after-free in __ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998)\n Read of size 8 at addr ffff8880106ec000 by task exploit/153\n Call Trace:\n ...\n kasan_report (mm/kasan/report.c:595)\n __ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998)\n ipv6_chk_addr (net/ipv6/addrconf.c:2031 net/ipv6/addrconf.c:1972)\n rds_tcp_laddr_check (net/rds/tcp.c:370)\n rds_bind (net/rds/bind.c:248)\n __sys_bind (net/socket.c:1920)\n __x64_sys_bind (net/socket.c:1956)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The slab use-after-free is reached via the bind(2) syscall on an AF_RDS socket with a link-local IPv6 address and non-zero scope_id; the KASAN reproducer follows bind()-\u003erds_bind()-\u003erds_tcp_laddr_check(), requiring on-host access to race bind against RTM_DELLINK netlink deletion of the referenced netdev.\nAC:L - Exploitation requires racing rds_tcp_laddr_check() against RTM_DELLINK freeing the netdev; the attacker controls both sides by concurrently calling bind() and deleting the interface via netlink (e.g., a veth in a user namespace) and can retry until the race succeeds.\nPR:L - An unprivileged local user can create AF_RDS sockets and call bind(); the RTM_DELLINK race is achievable with CAP_NET_ADMIN obtainable inside an unprivileged user+network namespace (unshare -Urn), not requiring init-namespace root.\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through bind/netlink syscalls without needing another user to mount a filesystem, click, or open a file.\nS:U - Impact is confined to kernel memory corruption and potential privilege escalation within the same kernel/host security boundary; this is not a VM-guest-to-host escape, sandbox escape, or cross-authority boundary crossing.\nC:H - The bug is a slab use-after-free read of a freed struct net_device in __ipv6_chk_addr_and_flags() via a stale pointer passed to ipv6_chk_addr(); UAF reads of kernel heap objects can disclose sensitive memory and enable further exploitation.\nI:H - Use-after-free on struct net_device heap memory provides memory corruption primitives that can be groomed for arbitrary kernel writes, control-flow hijacking, and local privilege escalation, not merely a bounded or transient error.\nA:H - The reported KASAN slab-use-after-free causes kernel oops/panic during the stale dereference in the IPv6 address-check path; UAF conditions are inherently crash-prone even when not fully weaponized for code execution."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:39:02.416Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f8a8977af2134a1d91e5f9773cb7d9d53278c830"
},
{
"url": "https://git.kernel.org/stable/c/ba95bce5dfe6e2ef602a87e0557225f2934ccb5c"
},
{
"url": "https://git.kernel.org/stable/c/c4933624a6f416ecfcc31ab58d585da1207a0597"
},
{
"url": "https://git.kernel.org/stable/c/76dd48886eeeb5fcf2b837d2f4c3d17eebeac9ef"
},
{
"url": "https://git.kernel.org/stable/c/f0d1fb05d70c8a561cd8d0473bcacafa2fc137ff"
},
{
"url": "https://git.kernel.org/stable/c/b1d480fce05f857dc438080cd8c9244b84a83494"
},
{
"url": "https://git.kernel.org/stable/c/8398bc477d3cb3e2b018a5aaac2bec0f69acda30"
},
{
"url": "https://git.kernel.org/stable/c/78f75d632f74b8de0f081a128588f7c37d0d1164"
}
],
"title": "rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74563",
"datePublished": "2026-08-15T12:28:05.768Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-08-19T16:39:02.416Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74563",
"date": "2026-10-01",
"epss": "0.00117",
"percentile": "0.01516"
},
"microsoft_vex": {
"current_release_date": "2026-09-25T01:48:55.000Z",
"cve": "CVE-2026-74563",
"id": "msrc_CVE-2026-74563",
"initial_release_date": "2026-08-23T14:46:45.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74563.json",
"version": "3"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f8a8977af2134a1d91e5f9773cb7d9d53278c830",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "ba95bce5dfe6e2ef602a87e0557225f2934ccb5c",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "c4933624a6f416ecfcc31ab58d585da1207a0597",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "76dd48886eeeb5fcf2b837d2f4c3d17eebeac9ef",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "f0d1fb05d70c8a561cd8d0473bcacafa2fc137ff",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "b1d480fce05f857dc438080cd8c9244b84a83494",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "8398bc477d3cb3e2b018a5aaac2bec0f69acda30",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
},
{
"lessThan": "78f75d632f74b8de0f081a128588f7c37d0d1164",
"status": "affected",
"version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()\n\nrds_tcp_laddr_check() looks up a scoped IPv6 interface with\ndev_get_by_index_rcu(), drops the RCU read-side lock, and only then\npasses the bare struct net_device * into ipv6_chk_addr().\n\ndev_get_by_index_rcu() only keeps the device alive within the same RCU\nread-side section. After rcu_read_unlock(), a concurrent RTM_DELLINK can\nfree the net_device; ipv6_chk_addr() then dereferences the stale pointer\nin __ipv6_chk_addr_and_flags() (e.g. l3mdev_master_dev_rcu(dev)), reading\nfreed memory.\n\nKeep the RCU read-side lock held across the ipv6_chk_addr() call instead\nof dropping it right after the lookup, so the device cannot be freed\nwhile it is in use.\n\n BUG: KASAN: slab-use-after-free in __ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998)\n Read of size 8 at addr ffff8880106ec000 by task exploit/153\n Call Trace:\n ...\n kasan_report (mm/kasan/report.c:595)\n __ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998)\n ipv6_chk_addr (net/ipv6/addrconf.c:2031 net/ipv6/addrconf.c:1972)\n rds_tcp_laddr_check (net/rds/tcp.c:370)\n rds_bind (net/rds/bind.c:248)\n __sys_bind (net/socket.c:1920)\n __x64_sys_bind (net/socket.c:1956)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)"
}
],
"id": "CVE-2026-74563",
"lastModified": "2026-08-19T17:21:11.107",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-08-15T13:18:01.790",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/76dd48886eeeb5fcf2b837d2f4c3d17eebeac9ef"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/78f75d632f74b8de0f081a128588f7c37d0d1164"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/8398bc477d3cb3e2b018a5aaac2bec0f69acda30"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/b1d480fce05f857dc438080cd8c9244b84a83494"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/ba95bce5dfe6e2ef602a87e0557225f2934ccb5c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/c4933624a6f416ecfcc31ab58d585da1207a0597"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/f0d1fb05d70c8a561cd8d0473bcacafa2fc137ff"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/f8a8977af2134a1d91e5f9773cb7d9d53278c830"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-19T19:39:57+00:00",
"cve": "CVE-2026-74563",
"id": "CVE-2026-74563",
"initial_release_date": "2026-08-15T00:00:00+00:00",
"product_status:known_affected": "14",
"product_status:known_not_affected": "260",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74563.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-22T16:35:08Z",
"cve": "CVE-2026-74563",
"id": "CVE-2026-74563",
"initial_release_date": "2026-08-15T23:50:08Z",
"product_status:first_fixed": "60",
"product_status:known_affected": "626",
"product_status:known_not_affected": "93",
"product_status:recommended": "107",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-74563",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74563.json",
"version": "12"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…