GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74601 (GCVE-0-2026-74601)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:31 – Updated: 2026-08-25 05:40
VLAI
Title
ring-buffer: Use current_context for safe per-CPU buffer swap
Summary
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Use current_context for safe per-CPU buffer swap The ring_buffer_swap_cpu() function currently checks the per-CPU committing counter to determine if a buffer is actively being written to before performing the swap. However, there exists a race window where this check can be bypassed: ring_buffer_lock_reserve cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_a rb_reserve_next_event rb_start_commit // inc committing if (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) {...} __rb_reserve_next rb_move_tail rb_end_commit(cpu_buffer); // dec committing => 0 /* interrupt hits here, successfully swaps! */ local_inc(&cpu_buffer->committing); ring_buffer_unlock_commit cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_b rb_commit rb_end_commit RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing)) // triggers warning The committing counter can temporarily drop to 0 during a single write operation (within rb_move_tail), creating a window where swap can succeed even though the write is still in progress. This leads to inconsistent buffer state and triggers the RB_WARN_ON in rb_commit(). Replace the committing counter check with current_context checks, which are set at the entry of ring_buffer_lock_reserve() and remain valid throughout the entire write operation, providing a reliable indicator of buffer busy state during swap.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4239c38fe0b3847e1e6d962c74b41b08ba0e2990 , < 26662bc8fced1d668fa1aa146eda085bfc67bd0b (git)
Affected: 4239c38fe0b3847e1e6d962c74b41b08ba0e2990 , < 6b524e6b234e45c7f5f90d13b042c6f57f80105c (git)
Affected: 4239c38fe0b3847e1e6d962c74b41b08ba0e2990 , < 597f279b7b4a06412e3d965e98cc36e181cdbede (git)
Affected: 4239c38fe0b3847e1e6d962c74b41b08ba0e2990 , < 22709117d9ae95e52673685f98caac7c356a8227 (git)
Affected: 4239c38fe0b3847e1e6d962c74b41b08ba0e2990 , < ad7e10c7ea89af45ac1bf1814855d45da472703d (git)
Affected: 4239c38fe0b3847e1e6d962c74b41b08ba0e2990 , < 5b926fb04cb9ef3156dcf88c69a59d3d1a1c4f9f (git)
Affected: 4239c38fe0b3847e1e6d962c74b41b08ba0e2990 , < 5e6e2a18c20e88167d414f666032792e8bf19b80 (git)
Affected: 4239c38fe0b3847e1e6d962c74b41b08ba0e2990 , < f27bdc43077e4fcb5557dfc315ee8d91e741f483 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.5
Unaffected: 0 , < 4.5 (semver)
Unaffected: 5.10.266 , ≤ 5.10.* (semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.153 , ≤ 6.6.* (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "26662bc8fced1d668fa1aa146eda085bfc67bd0b",
              "status": "affected",
              "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990",
              "versionType": "git"
            },
            {
              "lessThan": "6b524e6b234e45c7f5f90d13b042c6f57f80105c",
              "status": "affected",
              "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990",
              "versionType": "git"
            },
            {
              "lessThan": "597f279b7b4a06412e3d965e98cc36e181cdbede",
              "status": "affected",
              "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990",
              "versionType": "git"
            },
            {
              "lessThan": "22709117d9ae95e52673685f98caac7c356a8227",
              "status": "affected",
              "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990",
              "versionType": "git"
            },
            {
              "lessThan": "ad7e10c7ea89af45ac1bf1814855d45da472703d",
              "status": "affected",
              "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990",
              "versionType": "git"
            },
            {
              "lessThan": "5b926fb04cb9ef3156dcf88c69a59d3d1a1c4f9f",
              "status": "affected",
              "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990",
              "versionType": "git"
            },
            {
              "lessThan": "5e6e2a18c20e88167d414f666032792e8bf19b80",
              "status": "affected",
              "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990",
              "versionType": "git"
            },
            {
              "lessThan": "f27bdc43077e4fcb5557dfc315ee8d91e741f483",
              "status": "affected",
              "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.5"
            },
            {
              "lessThan": "4.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Use current_context for safe per-CPU buffer swap\n\nThe ring_buffer_swap_cpu() function currently checks the per-CPU\ncommitting counter to determine if a buffer is actively being written to\nbefore performing the swap. However, there exists a race window where\nthis check can be bypassed:\n\n    ring_buffer_lock_reserve\n        cpu_buffer = buffer-\u003ebuffers[cpu];       // cpu_buffer_a\n        rb_reserve_next_event\n            rb_start_commit // inc committing\n            if (unlikely(READ_ONCE(cpu_buffer-\u003ebuffer) != buffer)) {...}\n            __rb_reserve_next\n                rb_move_tail\n                    rb_end_commit(cpu_buffer);   // dec committing =\u003e 0\n                    /* interrupt hits here, successfully swaps! */\n                    local_inc(\u0026cpu_buffer-\u003ecommitting);\n\n    ring_buffer_unlock_commit\n        cpu_buffer = buffer-\u003ebuffers[cpu];      // cpu_buffer_b\n        rb_commit\n            rb_end_commit\n            RB_WARN_ON(cpu_buffer, !local_read(\u0026cpu_buffer-\u003ecommitting))\n                                                // triggers warning\n\nThe committing counter can temporarily drop to 0 during a single write\noperation (within rb_move_tail), creating a window where swap can\nsucceed even though the write is still in progress. This leads to\ninconsistent buffer state and triggers the RB_WARN_ON in rb_commit().\n\nReplace the committing counter check with current_context checks, which\nare set at the entry of ring_buffer_lock_reserve() and remain valid\nthroughout the entire write operation, providing a reliable indicator of\nbuffer busy state during swap."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local tracefs writes to snapshot or latency tracers; ring_buffer_swap_cpu() is only reached from update_max_tr_single() via tracing_snapshot_write or irqsoff/preemptoff tracers, with no network, adjacent, or physical entry path.\nAC:L - The attacker controls both sides of the race by enabling irqsoff/preemptoff tracing or hammering per_cpu/*/snapshot while generating trace events that cross page boundaries, reliably hitting the rb_move_tail window where committing briefly drops to zero.\nPR:L - tracing_check_open_get_tr() enforces only LOCKDOWN_TRACEFS and DAC with no capable() check; tracefs gid= mounts, Android/Perfetto/ChromeOS tracing groups, and container user+mount namespaces routinely grant unprivileged local write access to snapshot and current_tracer.\nUI:N - The attacker enables tracers and triggers buffer swaps through their own tracefs writes and syscalls; no victim cooperation, unrelated user action, or third-party interaction is required.\nS:U - Impact is corrupted kernel ring-buffer metadata and WARN_ON within the same kernel security domain; this is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Swapping per-CPU buffers mid-write leaves ring_buffer_per_cpu page, tail, and commit state inconsistent across buffers; subsequent trace reads or commits can access wrong backing pages, constituting kernel-memory corruption with arbitrary-read potential.\nI:H - Mid-reservation buffer swap causes unlock_commit on the wrong cpu_buffer with mismatched tail/commit page pointers, corrupting ring-buffer page lists and write metadata in ways exploitable for heap corruption and control-flow manipulation.\nA:H - rb_end_commit() hits RB_WARN_ON triggering WARN_ON and disabling recording; corrupted ring-buffer page state from this swap race has caused kernel oops/panic in related ring_buffer_swap_cpu bugs, and panic_on_warn makes the WARN fatal."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:26.170Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/26662bc8fced1d668fa1aa146eda085bfc67bd0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b524e6b234e45c7f5f90d13b042c6f57f80105c"
        },
        {
          "url": "https://git.kernel.org/stable/c/597f279b7b4a06412e3d965e98cc36e181cdbede"
        },
        {
          "url": "https://git.kernel.org/stable/c/22709117d9ae95e52673685f98caac7c356a8227"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad7e10c7ea89af45ac1bf1814855d45da472703d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b926fb04cb9ef3156dcf88c69a59d3d1a1c4f9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e6e2a18c20e88167d414f666032792e8bf19b80"
        },
        {
          "url": "https://git.kernel.org/stable/c/f27bdc43077e4fcb5557dfc315ee8d91e741f483"
        }
      ],
      "title": "ring-buffer: Use current_context for safe per-CPU buffer swap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74601",
    "datePublished": "2026-08-22T15:31:50.092Z",
    "dateReserved": "2026-08-15T05:44:03.919Z",
    "dateUpdated": "2026-08-25T05:40:26.170Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74601",
      "date": "2026-09-17",
      "epss": "0.00136",
      "percentile": "0.03377"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:48:23.000Z",
      "cve": "CVE-2026-74601",
      "id": "msrc_CVE-2026-74601",
      "initial_release_date": "2026-08-24T01:05:05.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ring-buffer: Use current_context for safe per-CPU buffer swap",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74601.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74601\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:32.530\",\"lastModified\":\"2026-08-25T06:18:36.057\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nring-buffer: Use current_context for safe per-CPU buffer swap\\n\\nThe ring_buffer_swap_cpu() function currently checks the per-CPU\\ncommitting counter to determine if a buffer is actively being written to\\nbefore performing the swap. However, there exists a race window where\\nthis check can be bypassed:\\n\\n    ring_buffer_lock_reserve\\n        cpu_buffer = buffer-\u003ebuffers[cpu];       // cpu_buffer_a\\n        rb_reserve_next_event\\n            rb_start_commit // inc committing\\n            if (unlikely(READ_ONCE(cpu_buffer-\u003ebuffer) != buffer)) {...}\\n            __rb_reserve_next\\n                rb_move_tail\\n                    rb_end_commit(cpu_buffer);   // dec committing =\u003e 0\\n                    /* interrupt hits here, successfully swaps! */\\n                    local_inc(\u0026cpu_buffer-\u003ecommitting);\\n\\n    ring_buffer_unlock_commit\\n        cpu_buffer = buffer-\u003ebuffers[cpu];      // cpu_buffer_b\\n        rb_commit\\n            rb_end_commit\\n            RB_WARN_ON(cpu_buffer, !local_read(\u0026cpu_buffer-\u003ecommitting))\\n                                                // triggers warning\\n\\nThe committing counter can temporarily drop to 0 during a single write\\noperation (within rb_move_tail), creating a window where swap can\\nsucceed even though the write is still in progress. This leads to\\ninconsistent buffer state and triggers the RB_WARN_ON in rb_commit().\\n\\nReplace the committing counter check with current_context checks, which\\nare set at the entry of ring_buffer_lock_reserve() and remain valid\\nthroughout the entire write operation, providing a reliable indicator of\\nbuffer busy state during swap.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/ring_buffer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4239c38fe0b3847e1e6d962c74b41b08ba0e2990\",\"lessThan\":\"26662bc8fced1d668fa1aa146eda085bfc67bd0b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4239c38fe0b3847e1e6d962c74b41b08ba0e2990\",\"lessThan\":\"6b524e6b234e45c7f5f90d13b042c6f57f80105c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4239c38fe0b3847e1e6d962c74b41b08ba0e2990\",\"lessThan\":\"597f279b7b4a06412e3d965e98cc36e181cdbede\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4239c38fe0b3847e1e6d962c74b41b08ba0e2990\",\"lessThan\":\"22709117d9ae95e52673685f98caac7c356a8227\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4239c38fe0b3847e1e6d962c74b41b08ba0e2990\",\"lessThan\":\"ad7e10c7ea89af45ac1bf1814855d45da472703d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4239c38fe0b3847e1e6d962c74b41b08ba0e2990\",\"lessThan\":\"5b926fb04cb9ef3156dcf88c69a59d3d1a1c4f9f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4239c38fe0b3847e1e6d962c74b41b08ba0e2990\",\"lessThan\":\"5e6e2a18c20e88167d414f666032792e8bf19b80\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4239c38fe0b3847e1e6d962c74b41b08ba0e2990\",\"lessThan\":\"f27bdc43077e4fcb5557dfc315ee8d91e741f483\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/ring_buffer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.266\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.217\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.184\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.153\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/22709117d9ae95e52673685f98caac7c356a8227\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/26662bc8fced1d668fa1aa146eda085bfc67bd0b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/597f279b7b4a06412e3d965e98cc36e181cdbede\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5b926fb04cb9ef3156dcf88c69a59d3d1a1c4f9f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5e6e2a18c20e88167d414f666032792e8bf19b80\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6b524e6b234e45c7f5f90d13b042c6f57f80105c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ad7e10c7ea89af45ac1bf1814855d45da472703d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f27bdc43077e4fcb5557dfc315ee8d91e741f483\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-25T10:01:10+00:00",
      "cve": "CVE-2026-74601",
      "id": "CVE-2026-74601",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ring-buffer: Use current_context for safe per-CPU buffer swap",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74601.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:18:05Z",
      "cve": "CVE-2026-74601",
      "id": "CVE-2026-74601",
      "initial_release_date": "2026-08-23T00:06:08Z",
      "product_status:known_affected": "351",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74601",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74601.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.