GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74609 (GCVE-0-2026-74609)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:31 – Updated: 2026-08-25 05:40
VLAI
Title
tipc: read le->link under the node lock in tipc_node_link_down()
Summary
In the Linux kernel, the following vulnerability has been resolved: tipc: read le->link under the node lock in tipc_node_link_down() tipc_node_link_down() caches the link pointer before taking n->lock: struct tipc_link *l = le->link; /* unlocked */ if (!l) return; tipc_node_write_lock(n); if (!tipc_link_is_establishing(l)) { /* deref l */ ... tipc_link_reset(l); /* write into l */ if (delete) { kfree(l); le->link = NULL; The delete=true caller frees that very object under n->lock, so the lock does not protect the cached pointer against it: - CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link supervision timer via tipc_node_timeout(), reads l unlocked and then dereferences it under n->lock; - CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -> bearer_disable() -> tipc_node_delete_links() -> tipc_node_link_down(n, bearer_id, true) -> kfree(l). The link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers disable_media() only schedules the asynchronous cleanup_bearer() work, so its synchronize_net() runs after the links are already gone. An in-flight CPU A that has read l therefore dereferences freed memory once B frees it: a use-after-free read in tipc_link_is_establishing(), and a use-after-free write via tipc_link_reset() on the establishing branch. The following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6: BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285) Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0 tipc_link_is_establishing (net/tipc/link.c:285) tipc_node_link_down (net/tipc/node.c:1076) tipc_node_timeout (net/tipc/node.c:843) Allocated by task 9549: tipc_link_create (net/tipc/link.c:490) tipc_node_check_dest (net/tipc/node.c:1279) tipc_disc_rcv (net/tipc/discover.c:252) tipc_udp_recv (net/tipc/udp_media.c:389) Freed by task 9549: tipc_node_link_down (net/tipc/node.c:1084) tipc_node_delete_links (net/tipc/node.c:1320) bearer_disable (net/tipc/bearer.c:414) __tipc_nl_bearer_disable (net/tipc/bearer.c:992) Move the le->link read inside tipc_node_write_lock(), so it is serialised against the kfree() in the delete path. A racing teardown now either has not run yet, and we see a valid link, or has already run, and we see NULL.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 73f646cec35477b5099d7e952297cb9e1855be45 , < 2be741ad565c610871a6a95062c12c39da7168fd (git)
Affected: 73f646cec35477b5099d7e952297cb9e1855be45 , < 69d209461c110388710e483a130caf051e4fd09a (git)
Affected: 73f646cec35477b5099d7e952297cb9e1855be45 , < de017c22135f545ca4e65d1eada22887b64958eb (git)
Affected: 73f646cec35477b5099d7e952297cb9e1855be45 , < 47ba70891b10b2feb52462086b7fcd2ad75d3ce3 (git)
Affected: 73f646cec35477b5099d7e952297cb9e1855be45 , < a714d62513befef37f71f4ae89bb1fe173b65f2e (git)
Affected: 73f646cec35477b5099d7e952297cb9e1855be45 , < c3f2347a47754eac690967cfd82cb6d559817b07 (git)
Affected: 73f646cec35477b5099d7e952297cb9e1855be45 , < 5558a8312452ddb21eff22b1cbd84302ad951944 (git)
Affected: 73f646cec35477b5099d7e952297cb9e1855be45 , < cba9ccb47e9fa4cc77692fb896cc5ab57a667882 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.4
Unaffected: 0 , < 4.4 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/node.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2be741ad565c610871a6a95062c12c39da7168fd",
              "status": "affected",
              "version": "73f646cec35477b5099d7e952297cb9e1855be45",
              "versionType": "git"
            },
            {
              "lessThan": "69d209461c110388710e483a130caf051e4fd09a",
              "status": "affected",
              "version": "73f646cec35477b5099d7e952297cb9e1855be45",
              "versionType": "git"
            },
            {
              "lessThan": "de017c22135f545ca4e65d1eada22887b64958eb",
              "status": "affected",
              "version": "73f646cec35477b5099d7e952297cb9e1855be45",
              "versionType": "git"
            },
            {
              "lessThan": "47ba70891b10b2feb52462086b7fcd2ad75d3ce3",
              "status": "affected",
              "version": "73f646cec35477b5099d7e952297cb9e1855be45",
              "versionType": "git"
            },
            {
              "lessThan": "a714d62513befef37f71f4ae89bb1fe173b65f2e",
              "status": "affected",
              "version": "73f646cec35477b5099d7e952297cb9e1855be45",
              "versionType": "git"
            },
            {
              "lessThan": "c3f2347a47754eac690967cfd82cb6d559817b07",
              "status": "affected",
              "version": "73f646cec35477b5099d7e952297cb9e1855be45",
              "versionType": "git"
            },
            {
              "lessThan": "5558a8312452ddb21eff22b1cbd84302ad951944",
              "status": "affected",
              "version": "73f646cec35477b5099d7e952297cb9e1855be45",
              "versionType": "git"
            },
            {
              "lessThan": "cba9ccb47e9fa4cc77692fb896cc5ab57a667882",
              "status": "affected",
              "version": "73f646cec35477b5099d7e952297cb9e1855be45",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/node.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: read le-\u003elink under the node lock in tipc_node_link_down()\n\ntipc_node_link_down() caches the link pointer before taking n-\u003elock:\n\n\tstruct tipc_link *l = le-\u003elink;\t\t/* unlocked */\n\n\tif (!l)\n\t\treturn;\n\ttipc_node_write_lock(n);\n\tif (!tipc_link_is_establishing(l)) {\t/* deref l */\n\t...\n\t\ttipc_link_reset(l);\t\t/* write into l */\n\tif (delete) {\n\t\tkfree(l);\n\t\tle-\u003elink = NULL;\n\nThe delete=true caller frees that very object under n-\u003elock, so the lock\ndoes not protect the cached pointer against it:\n\n - CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link\n   supervision timer via tipc_node_timeout(), reads l unlocked and then\n   dereferences it under n-\u003elock;\n - CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -\u003e bearer_disable()\n   -\u003e tipc_node_delete_links() -\u003e tipc_node_link_down(n, bearer_id, true)\n   -\u003e kfree(l).\n\nThe link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers\ndisable_media() only schedules the asynchronous cleanup_bearer() work, so\nits synchronize_net() runs after the links are already gone.  An in-flight\nCPU A that has read l therefore dereferences freed memory once B frees it:\na use-after-free read in tipc_link_is_establishing(), and a use-after-free\nwrite via tipc_link_reset() on the establishing branch.\n\nThe following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:\n\n  BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285)\n  Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0\n   tipc_link_is_establishing (net/tipc/link.c:285)\n   tipc_node_link_down (net/tipc/node.c:1076)\n   tipc_node_timeout (net/tipc/node.c:843)\n  Allocated by task 9549:\n   tipc_link_create (net/tipc/link.c:490)\n   tipc_node_check_dest (net/tipc/node.c:1279)\n   tipc_disc_rcv (net/tipc/discover.c:252)\n   tipc_udp_recv (net/tipc/udp_media.c:389)\n  Freed by task 9549:\n   tipc_node_link_down (net/tipc/node.c:1084)\n   tipc_node_delete_links (net/tipc/node.c:1320)\n   bearer_disable (net/tipc/bearer.c:414)\n   __tipc_nl_bearer_disable (net/tipc/bearer.c:992)\n\nMove the le-\u003elink read inside tipc_node_write_lock(), so it is serialised\nagainst the kfree() in the delete path.  A racing teardown now either has\nnot run yet, and we see a valid link, or has already run, and we see NULL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF race requires the delete=true path (kfree) via TIPC_NL_BEARER_DISABLE/bearer_disable() or netns teardown, reachable only through local RTNL/genlink with CAP_NET_ADMIN; remote tipc_rcv() packets alone cannot free links and complete the race.\nAC:L - An attacker with CAP_NET_ADMIN controls both CPUs by scripting bearer disable/netns teardown while concurrently driving link-down events via TIPC traffic or link supervision timers; KASAN reproduced this reliably without uncontrollable victim timing.\nPR:L - Bearer disable and link deletion require CAP_NET_ADMIN (GENL_UNS_ADMIN_PERM on TIPC_NL_BEARER_DISABLE); tipc_genl_family is netns-aware, so unprivileged users obtain effective net-admin via user/network namespaces (unshare -Urn).\nUI:N - No victim interaction is required; the attacker scripts bearer teardown and concurrent TIPC link activity from their own processes without needing another user to mount, open files, or perform administrative actions.\nS:U - Slab UAF corrupts host kernel heap memory within the same kernel security authority; impact is kernel crash or local privilege escalation, not a VM, IOMMU, or cross-container sandbox boundary escape.\nC:H - Slab use-after-free read in tipc_link_is_establishing() dereferences freed tipc_link objects (KASAN-confirmed), enabling disclosure of freed kernel memory and supporting further heap exploitation primitives.\nI:H - On the establishing branch tipc_link_reset() performs multiple writes into the freed tipc_link structure, corrupting kernel heap metadata and adjacent objects in ways exploitable for arbitrary write and control-flow hijacking.\nA:H - KASAN-confirmed slab-use-after-free in tipc_node_link_down() causes kernel oops/panic (observed on swapper during tipc_node_timeout), and the race can be retriggered during bearer teardown loops for reliable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:34.778Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2be741ad565c610871a6a95062c12c39da7168fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/69d209461c110388710e483a130caf051e4fd09a"
        },
        {
          "url": "https://git.kernel.org/stable/c/de017c22135f545ca4e65d1eada22887b64958eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/47ba70891b10b2feb52462086b7fcd2ad75d3ce3"
        },
        {
          "url": "https://git.kernel.org/stable/c/a714d62513befef37f71f4ae89bb1fe173b65f2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3f2347a47754eac690967cfd82cb6d559817b07"
        },
        {
          "url": "https://git.kernel.org/stable/c/5558a8312452ddb21eff22b1cbd84302ad951944"
        },
        {
          "url": "https://git.kernel.org/stable/c/cba9ccb47e9fa4cc77692fb896cc5ab57a667882"
        }
      ],
      "title": "tipc: read le-\u003elink under the node lock in tipc_node_link_down()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74609",
    "datePublished": "2026-08-22T15:31:56.054Z",
    "dateReserved": "2026-08-15T05:44:03.920Z",
    "dateUpdated": "2026-08-25T05:40:34.778Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74609",
      "date": "2026-09-16",
      "epss": "0.00126",
      "percentile": "0.02598"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:45:19.000Z",
      "cve": "CVE-2026-74609",
      "id": "msrc_CVE-2026-74609",
      "initial_release_date": "2026-08-24T01:02:04.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tipc: read le-\u003elink under the node lock in tipc_node_link_down()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74609.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74609\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:33.407\",\"lastModified\":\"2026-08-25T06:18:37.870\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntipc: read le-\u003elink under the node lock in tipc_node_link_down()\\n\\ntipc_node_link_down() caches the link pointer before taking n-\u003elock:\\n\\n\\tstruct tipc_link *l = le-\u003elink;\\t\\t/* unlocked */\\n\\n\\tif (!l)\\n\\t\\treturn;\\n\\ttipc_node_write_lock(n);\\n\\tif (!tipc_link_is_establishing(l)) {\\t/* deref l */\\n\\t...\\n\\t\\ttipc_link_reset(l);\\t\\t/* write into l */\\n\\tif (delete) {\\n\\t\\tkfree(l);\\n\\t\\tle-\u003elink = NULL;\\n\\nThe delete=true caller frees that very object under n-\u003elock, so the lock\\ndoes not protect the cached pointer against it:\\n\\n - CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link\\n   supervision timer via tipc_node_timeout(), reads l unlocked and then\\n   dereferences it under n-\u003elock;\\n - CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -\u003e bearer_disable()\\n   -\u003e tipc_node_delete_links() -\u003e tipc_node_link_down(n, bearer_id, true)\\n   -\u003e kfree(l).\\n\\nThe link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers\\ndisable_media() only schedules the asynchronous cleanup_bearer() work, so\\nits synchronize_net() runs after the links are already gone.  An in-flight\\nCPU A that has read l therefore dereferences freed memory once B frees it:\\na use-after-free read in tipc_link_is_establishing(), and a use-after-free\\nwrite via tipc_link_reset() on the establishing branch.\\n\\nThe following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:\\n\\n  BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285)\\n  Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0\\n   tipc_link_is_establishing (net/tipc/link.c:285)\\n   tipc_node_link_down (net/tipc/node.c:1076)\\n   tipc_node_timeout (net/tipc/node.c:843)\\n  Allocated by task 9549:\\n   tipc_link_create (net/tipc/link.c:490)\\n   tipc_node_check_dest (net/tipc/node.c:1279)\\n   tipc_disc_rcv (net/tipc/discover.c:252)\\n   tipc_udp_recv (net/tipc/udp_media.c:389)\\n  Freed by task 9549:\\n   tipc_node_link_down (net/tipc/node.c:1084)\\n   tipc_node_delete_links (net/tipc/node.c:1320)\\n   bearer_disable (net/tipc/bearer.c:414)\\n   __tipc_nl_bearer_disable (net/tipc/bearer.c:992)\\n\\nMove the le-\u003elink read inside tipc_node_write_lock(), so it is serialised\\nagainst the kfree() in the delete path.  A racing teardown now either has\\nnot run yet, and we see a valid link, or has already run, and we see NULL.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/tipc/node.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"73f646cec35477b5099d7e952297cb9e1855be45\",\"lessThan\":\"2be741ad565c610871a6a95062c12c39da7168fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"73f646cec35477b5099d7e952297cb9e1855be45\",\"lessThan\":\"69d209461c110388710e483a130caf051e4fd09a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"73f646cec35477b5099d7e952297cb9e1855be45\",\"lessThan\":\"de017c22135f545ca4e65d1eada22887b64958eb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"73f646cec35477b5099d7e952297cb9e1855be45\",\"lessThan\":\"47ba70891b10b2feb52462086b7fcd2ad75d3ce3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"73f646cec35477b5099d7e952297cb9e1855be45\",\"lessThan\":\"a714d62513befef37f71f4ae89bb1fe173b65f2e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"73f646cec35477b5099d7e952297cb9e1855be45\",\"lessThan\":\"c3f2347a47754eac690967cfd82cb6d559817b07\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"73f646cec35477b5099d7e952297cb9e1855be45\",\"lessThan\":\"5558a8312452ddb21eff22b1cbd84302ad951944\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"73f646cec35477b5099d7e952297cb9e1855be45\",\"lessThan\":\"cba9ccb47e9fa4cc77692fb896cc5ab57a667882\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/tipc/node.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2be741ad565c610871a6a95062c12c39da7168fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/47ba70891b10b2feb52462086b7fcd2ad75d3ce3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5558a8312452ddb21eff22b1cbd84302ad951944\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/69d209461c110388710e483a130caf051e4fd09a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a714d62513befef37f71f4ae89bb1fe173b65f2e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c3f2347a47754eac690967cfd82cb6d559817b07\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cba9ccb47e9fa4cc77692fb896cc5ab57a667882\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/de017c22135f545ca4e65d1eada22887b64958eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:50:46+00:00",
      "cve": "CVE-2026-74609",
      "id": "CVE-2026-74609",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tipc: read le-\u003elink under the node lock in tipc_node_link_down()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74609.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:17:54Z",
      "cve": "CVE-2026-74609",
      "id": "CVE-2026-74609",
      "initial_release_date": "2026-09-02T01:04:04Z",
      "product_status:known_affected": "353",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74609",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74609.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.