CVE-2026-74518 (GCVE-0-2026-74518)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:38
VLAI
Title
mm/hugetlb: fix list corruption in allocate_file_region_entries()
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix list corruption in allocate_file_region_entries() allocate_file_region_entries() tops up resv->region_cache with freshly allocated file_region descriptors. The allocation uses GFP_KERNEL, so resv->lock is dropped around it: the new entries are gathered on a stack-local list head, allocated_regions, and spliced into resv->region_cache once the lock is re-acquired. The splice used list_splice(), which moves the entries but does not re-initialize the source head, so allocated_regions is left pointing at an entry that now lives on resv->region_cache. The top-up runs in a while loop that re-checks the cache deficit after re-acquiring the lock. For a shared mapping the resv_map is shared by every mapper of the hugetlbfs inode, so a concurrent region_chg()/region_add()/region_del() on the same resv_map can consume cache entries during the unlocked window and force a second iteration. That iteration calls list_add() on the stale head and corrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check trips: list_add corruption. next->prev should be prev (ffffc900011ff7f8), but was ffff88814c281460. (next=ffff88814c545640). kernel BUG at lib/list_debug.c:31! allocate_file_region_entries+0x191/0x420 region_chg+0x267/0x300 hugetlb_reserve_pages+0x387/0xc80 hugetlbfs_file_mmap+0x2ce/0x3f0 mmap_region+0x1348/0x1a80 do_mmap+0x85e/0xb90 vm_mmap_pgoff+0x18c/0x330 ksys_mmap_pgoff+0x2a1/0x3e0 do_syscall_64+0xd7/0x420 Without CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack address into resv->region_cache, leading to later use-after-free. This was observed as a real host panic on a dense KVM host where a QEMU guest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate SPDK/DPDK vhost-user target, generating concurrent region_* traffic on one shared resv_map. Use list_splice_init() so the source head is re-initialized empty after each splice, making the retry loop safe.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d3ec7b6e09e512ba902b86bcca2c512fb06d492f , < 01b8569233e47693d6ff7efa96d9854c55f936fc (git)
Affected: d3ec7b6e09e512ba902b86bcca2c512fb06d492f , < 9c5fdffc5e1ce84403c58289ee72697051803bf7 (git)
Affected: d3ec7b6e09e512ba902b86bcca2c512fb06d492f , < f3e54f6a5e1681f83d13e8716bc92ef5ecf121d3 (git)
Affected: d3ec7b6e09e512ba902b86bcca2c512fb06d492f , < 62e1c2741a4d923d9854efd5927a6212aad7a187 (git)
Affected: d3ec7b6e09e512ba902b86bcca2c512fb06d492f , < 587a0accc2b4fccc5cf7baf0fe34e50efde51f9c (git)
Affected: d3ec7b6e09e512ba902b86bcca2c512fb06d492f , < 126a70bf1a08ddc9d79c471ebdaa2b08cfbab8df (git)
Affected: d3ec7b6e09e512ba902b86bcca2c512fb06d492f , < ac1bb7fd45088d0db57a22ce7729f258ebd63cf5 (git)
Affected: d3ec7b6e09e512ba902b86bcca2c512fb06d492f , < dd9623f58ec702a07b2d67179d6fcea79c52231a (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/hugetlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "01b8569233e47693d6ff7efa96d9854c55f936fc",
              "status": "affected",
              "version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
              "versionType": "git"
            },
            {
              "lessThan": "9c5fdffc5e1ce84403c58289ee72697051803bf7",
              "status": "affected",
              "version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
              "versionType": "git"
            },
            {
              "lessThan": "f3e54f6a5e1681f83d13e8716bc92ef5ecf121d3",
              "status": "affected",
              "version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
              "versionType": "git"
            },
            {
              "lessThan": "62e1c2741a4d923d9854efd5927a6212aad7a187",
              "status": "affected",
              "version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
              "versionType": "git"
            },
            {
              "lessThan": "587a0accc2b4fccc5cf7baf0fe34e50efde51f9c",
              "status": "affected",
              "version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
              "versionType": "git"
            },
            {
              "lessThan": "126a70bf1a08ddc9d79c471ebdaa2b08cfbab8df",
              "status": "affected",
              "version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
              "versionType": "git"
            },
            {
              "lessThan": "ac1bb7fd45088d0db57a22ce7729f258ebd63cf5",
              "status": "affected",
              "version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
              "versionType": "git"
            },
            {
              "lessThan": "dd9623f58ec702a07b2d67179d6fcea79c52231a",
              "status": "affected",
              "version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/hugetlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix list corruption in allocate_file_region_entries()\n\nallocate_file_region_entries() tops up resv-\u003eregion_cache with freshly\nallocated file_region descriptors.  The allocation uses GFP_KERNEL, so\nresv-\u003elock is dropped around it: the new entries are gathered on a\nstack-local list head, allocated_regions, and spliced into\nresv-\u003eregion_cache once the lock is re-acquired.\n\nThe splice used list_splice(), which moves the entries but does not\nre-initialize the source head, so allocated_regions is left pointing at an\nentry that now lives on resv-\u003eregion_cache.  The top-up runs in a while\nloop that re-checks the cache deficit after re-acquiring the lock.  For a\nshared mapping the resv_map is shared by every mapper of the hugetlbfs\ninode, so a concurrent region_chg()/region_add()/region_del() on the same\nresv_map can consume cache entries during the unlocked window and force a\nsecond iteration.  That iteration calls list_add() on the stale head and\ncorrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check\ntrips:\n\n  list_add corruption. next-\u003eprev should be prev (ffffc900011ff7f8),\n  but was ffff88814c281460. (next=ffff88814c545640).\n  kernel BUG at lib/list_debug.c:31!\n   allocate_file_region_entries+0x191/0x420\n   region_chg+0x267/0x300\n   hugetlb_reserve_pages+0x387/0xc80\n   hugetlbfs_file_mmap+0x2ce/0x3f0\n   mmap_region+0x1348/0x1a80\n   do_mmap+0x85e/0xb90\n   vm_mmap_pgoff+0x18c/0x330\n   ksys_mmap_pgoff+0x2a1/0x3e0\n   do_syscall_64+0xd7/0x420\n\nWithout CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack\naddress into resv-\u003eregion_cache, leading to later use-after-free.\n\nThis was observed as a real host panic on a dense KVM host where a QEMU\nguest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate\nSPDK/DPDK vhost-user target, generating concurrent region_* traffic on one\nshared resv_map.\n\nUse list_splice_init() so the source head is re-initialized empty after\neach splice, making the retry loop safe."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local hugetlb reservation paths (mmap/memfd_create/fault syscalls into region_chg/region_add/region_del); no network protocol or remote packet handler invokes allocate_file_region_entries().\nAC:L - Exploitation needs a race while resv-\u003elock is dropped during GFP_KERNEL allocation, but an attacker can spawn concurrent MAP_SHARED mappers/faulters on one hugetlb inode and controls both sides of that race.\nPR:L - Unprivileged local users can trigger this via memfd_create(MFD_HUGETLB) plus MAP_SHARED mmap/fault activity, or by mapping accessible shared hugetlbfs files, without init-namespace root or special capabilities.\nUI:N - No victim interaction is required; the attacker drives the needed concurrent syscalls and shared hugetlb mappings themselves to hit the corrupted list splice retry path.\nS:U - Impact is kernel hugetlb resv_map list/memory corruption on the host; it does not by itself cross a VM, IOMMU, or separate security-authority boundary even though KVM/DPDK hosts are a prime deployment.\nC:H - Without CONFIG_DEBUG_LIST, stale list_splice leaves a kernel-stack pointer in resv-\u003eregion_cache, producing later use-after-free that can be turned into arbitrary kernel memory read/disclosure primitives.\nI:H - Corrupted region_cache pointers let subsequent region_add/region_del/cache operations write through attacker-influenced list links, enabling heap metadata corruption and potential arbitrary kernel write or code execution.\nA:H - Real host panics were reported on dense KVM hugetlb workloads; DEBUG_LIST kernels BUG on list_add corruption, and default builds can crash from UAF while walking the poisoned region_cache."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:38:19.402Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/01b8569233e47693d6ff7efa96d9854c55f936fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c5fdffc5e1ce84403c58289ee72697051803bf7"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3e54f6a5e1681f83d13e8716bc92ef5ecf121d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/62e1c2741a4d923d9854efd5927a6212aad7a187"
        },
        {
          "url": "https://git.kernel.org/stable/c/587a0accc2b4fccc5cf7baf0fe34e50efde51f9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/126a70bf1a08ddc9d79c471ebdaa2b08cfbab8df"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac1bb7fd45088d0db57a22ce7729f258ebd63cf5"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd9623f58ec702a07b2d67179d6fcea79c52231a"
        }
      ],
      "title": "mm/hugetlb: fix list corruption in allocate_file_region_entries()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74518",
    "datePublished": "2026-08-15T12:27:37.480Z",
    "dateReserved": "2026-08-15T05:44:03.910Z",
    "dateUpdated": "2026-08-19T16:38:19.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74518",
      "date": "2026-10-01",
      "epss": "0.00126",
      "percentile": "0.01941"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-25T02:03:38.000Z",
      "cve": "CVE-2026-74518",
      "id": "msrc_CVE-2026-74518",
      "initial_release_date": "2026-08-23T14:56:12.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mm/hugetlb: fix list corruption in allocate_file_region_entries()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74518.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "mm/hugetlb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "01b8569233e47693d6ff7efa96d9854c55f936fc",
                    "status": "affected",
                    "version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9c5fdffc5e1ce84403c58289ee72697051803bf7",
                    "status": "affected",
                    "version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f3e54f6a5e1681f83d13e8716bc92ef5ecf121d3",
                    "status": "affected",
                    "version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "62e1c2741a4d923d9854efd5927a6212aad7a187",
                    "status": "affected",
                    "version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "587a0accc2b4fccc5cf7baf0fe34e50efde51f9c",
                    "status": "affected",
                    "version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "126a70bf1a08ddc9d79c471ebdaa2b08cfbab8df",
                    "status": "affected",
                    "version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ac1bb7fd45088d0db57a22ce7729f258ebd63cf5",
                    "status": "affected",
                    "version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dd9623f58ec702a07b2d67179d6fcea79c52231a",
                    "status": "affected",
                    "version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "mm/hugetlb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.10"
                  },
                  {
                    "lessThan": "5.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix list corruption in allocate_file_region_entries()\n\nallocate_file_region_entries() tops up resv-\u003eregion_cache with freshly\nallocated file_region descriptors.  The allocation uses GFP_KERNEL, so\nresv-\u003elock is dropped around it: the new entries are gathered on a\nstack-local list head, allocated_regions, and spliced into\nresv-\u003eregion_cache once the lock is re-acquired.\n\nThe splice used list_splice(), which moves the entries but does not\nre-initialize the source head, so allocated_regions is left pointing at an\nentry that now lives on resv-\u003eregion_cache.  The top-up runs in a while\nloop that re-checks the cache deficit after re-acquiring the lock.  For a\nshared mapping the resv_map is shared by every mapper of the hugetlbfs\ninode, so a concurrent region_chg()/region_add()/region_del() on the same\nresv_map can consume cache entries during the unlocked window and force a\nsecond iteration.  That iteration calls list_add() on the stale head and\ncorrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check\ntrips:\n\n  list_add corruption. next-\u003eprev should be prev (ffffc900011ff7f8),\n  but was ffff88814c281460. (next=ffff88814c545640).\n  kernel BUG at lib/list_debug.c:31!\n   allocate_file_region_entries+0x191/0x420\n   region_chg+0x267/0x300\n   hugetlb_reserve_pages+0x387/0xc80\n   hugetlbfs_file_mmap+0x2ce/0x3f0\n   mmap_region+0x1348/0x1a80\n   do_mmap+0x85e/0xb90\n   vm_mmap_pgoff+0x18c/0x330\n   ksys_mmap_pgoff+0x2a1/0x3e0\n   do_syscall_64+0xd7/0x420\n\nWithout CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack\naddress into resv-\u003eregion_cache, leading to later use-after-free.\n\nThis was observed as a real host panic on a dense KVM host where a QEMU\nguest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate\nSPDK/DPDK vhost-user target, generating concurrent region_* traffic on one\nshared resv_map.\n\nUse list_splice_init() so the source head is re-initialized empty after\neach splice, making the retry loop safe."
          }
        ],
        "id": "CVE-2026-74518",
        "lastModified": "2026-08-19T17:21:08.543",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:17:56.967",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/01b8569233e47693d6ff7efa96d9854c55f936fc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/126a70bf1a08ddc9d79c471ebdaa2b08cfbab8df"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/587a0accc2b4fccc5cf7baf0fe34e50efde51f9c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/62e1c2741a4d923d9854efd5927a6212aad7a187"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9c5fdffc5e1ce84403c58289ee72697051803bf7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ac1bb7fd45088d0db57a22ce7729f258ebd63cf5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dd9623f58ec702a07b2d67179d6fcea79c52231a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f3e54f6a5e1681f83d13e8716bc92ef5ecf121d3"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-24T03:32:07+00:00",
      "cve": "CVE-2026-74518",
      "id": "CVE-2026-74518",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74518.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-24T16:29:14Z",
      "cve": "CVE-2026-74518",
      "id": "CVE-2026-74518",
      "initial_release_date": "2026-08-15T23:51:08Z",
      "product_status:first_fixed": "164",
      "product_status:known_affected": "522",
      "product_status:known_not_affected": "143",
      "product_status:recommended": "259",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74518",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74518.json",
      "version": "15"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.