GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74714 (GCVE-0-2026-74714)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:41
VLAI
Title
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto the ehash chain, drops the bucket lock, and only afterwards sets rsk_refcnt to 3. Lockless readers such as __inet_lookup_established() handle this with refcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain sock_hold() while holding the bucket lock, on the assumption that the lock guarantees sk_refcnt > 0. That assumption does not hold for request_sock: CPU 0 CPU 1 ----- ----- tcp_conn_request() reqsk_queue_hash_req() inet_ehash_insert(req) spin_lock(bucket) __sk_nulls_add_node_rcu(req) // rsk_refcnt == 0 spin_unlock(bucket) bpf_iter_tcp_established_batch() spin_lock(bucket) sock_hold(req) <-- addition on 0 spin_unlock(bucket) refcount_set(&req->rsk_refcnt, 3) // clobbers saturated value which surfaces as: refcount_t: addition on 0; use-after-free. WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1 Call Trace: bpf_iter_tcp_established_batch+0x14e/0x170 bpf_iter_tcp_batch+0x53/0x200 bpf_iter_tcp_seq_next+0x27/0x70 bpf_seq_read+0x107/0x410 vfs_read+0xb9/0x380 The iterator's stolen reference is lost when the publishing CPU's refcount_set() overwrites the count, leaving the socket one reference short. When the last legitimate owner drops its reference the reqsk is freed while still reachable, leading to use-after-free. This reproduces in seconds with tcp_syncookies=0, a handful of threads doing connect()/close() to a local listener while others read an iter/tcp link in a tight loop. Use refcount_inc_not_zero() and skip the socket on failure. A skipped socket is still part of the bucket, so keep counting it in expected. The reallocations are sized from expected, and a request sock whose refcount gets published while the lock is held across the last realloc must already have room. A skipped socket is counted in expected but never batched, so end_sk can be short of expected on a batch that is actually complete. Decide completeness by whether the walk left any socket behind instead. The WARN after the locked realloc checks the same, replacing an end_sk == expected check that could not hold on that path since commit cdec67a489d4 ("bpf: tcp: Make sure iter->batch always contains a full bucket snapshot"). If every matching socket in a bucket is mid-init (refcount 0), end_sk stays 0. Advance to the next bucket rather than returning a batch entry that was never filled this round.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < cc0295f89296ed351fc4b0b48fee887ba02c5d24 (git)
Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < ddbe966b5d1fe212ada749bc3d0b410f1a7dea74 (git)
Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < 7d2b60a4bc0499f62ff8520af6309bbe170882fd (git)
Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < cefcbbe20846a45f9a7dae868f7ef1000953e2df (git)
Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < 97e74d3e45d653c07c2d406fc530a9bbe3df8396 (git)
Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < e5fd3f514e27db1f05fbd72ba615d74941e23c51 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_ipv4.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc0295f89296ed351fc4b0b48fee887ba02c5d24",
              "status": "affected",
              "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
              "versionType": "git"
            },
            {
              "lessThan": "ddbe966b5d1fe212ada749bc3d0b410f1a7dea74",
              "status": "affected",
              "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
              "versionType": "git"
            },
            {
              "lessThan": "7d2b60a4bc0499f62ff8520af6309bbe170882fd",
              "status": "affected",
              "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
              "versionType": "git"
            },
            {
              "lessThan": "cefcbbe20846a45f9a7dae868f7ef1000953e2df",
              "status": "affected",
              "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
              "versionType": "git"
            },
            {
              "lessThan": "97e74d3e45d653c07c2d406fc530a9bbe3df8396",
              "status": "affected",
              "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
              "versionType": "git"
            },
            {
              "lessThan": "e5fd3f514e27db1f05fbd72ba615d74941e23c51",
              "status": "affected",
              "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_ipv4.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()\n\nreqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto\nthe ehash chain, drops the bucket lock, and only afterwards sets\nrsk_refcnt to 3.\n\nLockless readers such as __inet_lookup_established() handle this with\nrefcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain\nsock_hold() while holding the bucket lock, on the assumption that the\nlock guarantees sk_refcnt \u003e 0. That assumption does not hold for\nrequest_sock:\n\n  CPU 0                                CPU 1\n  -----                                -----\n  tcp_conn_request()\n   reqsk_queue_hash_req()\n    inet_ehash_insert(req)\n     spin_lock(bucket)\n     __sk_nulls_add_node_rcu(req)      // rsk_refcnt == 0\n     spin_unlock(bucket)\n                                       bpf_iter_tcp_established_batch()\n                                        spin_lock(bucket)\n                                        sock_hold(req)   \u003c-- addition on 0\n                                        spin_unlock(bucket)\n    refcount_set(\u0026req-\u003ersk_refcnt, 3)  // clobbers saturated value\n\nwhich surfaces as:\n\n  refcount_t: addition on 0; use-after-free.\n  WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1\n  Call Trace:\n   bpf_iter_tcp_established_batch+0x14e/0x170\n   bpf_iter_tcp_batch+0x53/0x200\n   bpf_iter_tcp_seq_next+0x27/0x70\n   bpf_seq_read+0x107/0x410\n   vfs_read+0xb9/0x380\n\nThe iterator\u0027s stolen reference is lost when the publishing CPU\u0027s\nrefcount_set() overwrites the count, leaving the socket one reference\nshort. When the last legitimate owner drops its reference the reqsk is\nfreed while still reachable, leading to use-after-free.\n\nThis reproduces in seconds with tcp_syncookies=0, a handful of threads\ndoing connect()/close() to a local listener while others read an\niter/tcp link in a tight loop.\n\nUse refcount_inc_not_zero() and skip the socket on failure. A skipped\nsocket is still part of the bucket, so keep counting it in expected.\nThe reallocations are sized from expected, and a request sock whose\nrefcount gets published while the lock is held across the last realloc\nmust already have room.\n\nA skipped socket is counted in expected but never batched, so end_sk\ncan be short of expected on a batch that is actually complete. Decide\ncompleteness by whether the walk left any socket behind instead. The\nWARN after the locked realloc checks the same, replacing an\nend_sk == expected check that could not hold on that path since\ncommit cdec67a489d4 (\"bpf: tcp: Make sure iter-\u003ebatch always\ncontains a full bucket snapshot\").\n\nIf every matching socket in a bucket is mid-init (refcount 0), end_sk\nstays 0. Advance to the next bucket rather than returning a batch entry\nthat was never filled this round."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - bpf_iter_tcp_established_batch() is reached only via local bpf() to load a BPF_TRACE_ITER TCP program, create an iterator link/fd, and read() it (bpf_seq_read-\u003ebpf_iter_tcp_batch); per kernel CNA guidance BPF iterator paths are Local even though concurrent TCP_NEW_SYN_RECV creation can be driven by network SYNs.\nAC:L - The fix commit reproduces in seconds with threads doing connect()/close() while others read iter/tcp in a tight loop; the attacker controls both the BPF iterator and TCP connection churn, so the refcount race between sock_hold() and refcount_set() is reliably winnable without uncontrollable victim state.\nPR:L - Loading BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER requires CAP_BPF and CAP_PERFMON at bpf_prog_load(); per kernel CNA guidance these are Low privileges because BPF tokens and user namespaces can delegate them to non-init-namespace users, not only real root.\nUI:N - No victim interaction is required; the attacker loads their own iter/tcp BPF program and link, then triggers the race with self-generated connect/close traffic or SYN activity to listeners in the iterated network namespace.\nS:U - Impact is a kernel heap use-after-free and memory corruption within the same host kernel security authority; this is standard local kernel compromise/crash, not a VM escape, sandbox boundary cross, or IOMMU bypass.\nC:H - The iterator retains dangling request_sock pointers after refcount_set() clobbers a sock_hold() taken on sk_refcnt==0; subsequent bpf_iter_tcp_seq_show/put_batch dereference freed kernel objects, giving UAF read primitives per kernel CNA UAF guidance.\nI:H - Freed request_sock slabs can be reallocated while the iterator batch still references them; UAF enables corrupted socket metadata, refcount abuse, and control-flow hijacking via heap grooming, meeting High integrity under kernel CNA memory-corruption guidance.\nA:H - The bug surfaces as refcount_warn_saturate and leaves the reqsk one reference short so it is freed while still reachable from the iterator batch, causing kernel oops/panic; the tight-loop repro shows reliable, repeatable host denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:57.341Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cc0295f89296ed351fc4b0b48fee887ba02c5d24"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddbe966b5d1fe212ada749bc3d0b410f1a7dea74"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d2b60a4bc0499f62ff8520af6309bbe170882fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/cefcbbe20846a45f9a7dae868f7ef1000953e2df"
        },
        {
          "url": "https://git.kernel.org/stable/c/97e74d3e45d653c07c2d406fc530a9bbe3df8396"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5fd3f514e27db1f05fbd72ba615d74941e23c51"
        }
      ],
      "title": "bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74714",
    "datePublished": "2026-08-22T15:33:09.643Z",
    "dateReserved": "2026-08-15T05:44:03.928Z",
    "dateUpdated": "2026-08-25T05:41:57.341Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74714",
      "date": "2026-09-17",
      "epss": "0.00126",
      "percentile": "0.02602"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:45:28.000Z",
      "cve": "CVE-2026-74714",
      "id": "msrc_CVE-2026-74714",
      "initial_release_date": "2026-08-24T01:02:12.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74714.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74714\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:46.170\",\"lastModified\":\"2026-08-25T06:18:56.740\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()\\n\\nreqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto\\nthe ehash chain, drops the bucket lock, and only afterwards sets\\nrsk_refcnt to 3.\\n\\nLockless readers such as __inet_lookup_established() handle this with\\nrefcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain\\nsock_hold() while holding the bucket lock, on the assumption that the\\nlock guarantees sk_refcnt \u003e 0. That assumption does not hold for\\nrequest_sock:\\n\\n  CPU 0                                CPU 1\\n  -----                                -----\\n  tcp_conn_request()\\n   reqsk_queue_hash_req()\\n    inet_ehash_insert(req)\\n     spin_lock(bucket)\\n     __sk_nulls_add_node_rcu(req)      // rsk_refcnt == 0\\n     spin_unlock(bucket)\\n                                       bpf_iter_tcp_established_batch()\\n                                        spin_lock(bucket)\\n                                        sock_hold(req)   \u003c-- addition on 0\\n                                        spin_unlock(bucket)\\n    refcount_set(\u0026req-\u003ersk_refcnt, 3)  // clobbers saturated value\\n\\nwhich surfaces as:\\n\\n  refcount_t: addition on 0; use-after-free.\\n  WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1\\n  Call Trace:\\n   bpf_iter_tcp_established_batch+0x14e/0x170\\n   bpf_iter_tcp_batch+0x53/0x200\\n   bpf_iter_tcp_seq_next+0x27/0x70\\n   bpf_seq_read+0x107/0x410\\n   vfs_read+0xb9/0x380\\n\\nThe iterator\u0027s stolen reference is lost when the publishing CPU\u0027s\\nrefcount_set() overwrites the count, leaving the socket one reference\\nshort. When the last legitimate owner drops its reference the reqsk is\\nfreed while still reachable, leading to use-after-free.\\n\\nThis reproduces in seconds with tcp_syncookies=0, a handful of threads\\ndoing connect()/close() to a local listener while others read an\\niter/tcp link in a tight loop.\\n\\nUse refcount_inc_not_zero() and skip the socket on failure. A skipped\\nsocket is still part of the bucket, so keep counting it in expected.\\nThe reallocations are sized from expected, and a request sock whose\\nrefcount gets published while the lock is held across the last realloc\\nmust already have room.\\n\\nA skipped socket is counted in expected but never batched, so end_sk\\ncan be short of expected on a batch that is actually complete. Decide\\ncompleteness by whether the walk left any socket behind instead. The\\nWARN after the locked realloc checks the same, replacing an\\nend_sk == expected check that could not hold on that path since\\ncommit cdec67a489d4 (\\\"bpf: tcp: Make sure iter-\u003ebatch always\\ncontains a full bucket snapshot\\\").\\n\\nIf every matching socket in a bucket is mid-init (refcount 0), end_sk\\nstays 0. Advance to the next bucket rather than returning a batch entry\\nthat was never filled this round.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/tcp_ipv4.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"04c7820b776f1c4b48698574c47de9e940d368e8\",\"lessThan\":\"cc0295f89296ed351fc4b0b48fee887ba02c5d24\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04c7820b776f1c4b48698574c47de9e940d368e8\",\"lessThan\":\"ddbe966b5d1fe212ada749bc3d0b410f1a7dea74\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04c7820b776f1c4b48698574c47de9e940d368e8\",\"lessThan\":\"7d2b60a4bc0499f62ff8520af6309bbe170882fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04c7820b776f1c4b48698574c47de9e940d368e8\",\"lessThan\":\"cefcbbe20846a45f9a7dae868f7ef1000953e2df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04c7820b776f1c4b48698574c47de9e940d368e8\",\"lessThan\":\"97e74d3e45d653c07c2d406fc530a9bbe3df8396\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04c7820b776f1c4b48698574c47de9e940d368e8\",\"lessThan\":\"e5fd3f514e27db1f05fbd72ba615d74941e23c51\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/tcp_ipv4.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7d2b60a4bc0499f62ff8520af6309bbe170882fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/97e74d3e45d653c07c2d406fc530a9bbe3df8396\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cc0295f89296ed351fc4b0b48fee887ba02c5d24\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cefcbbe20846a45f9a7dae868f7ef1000953e2df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ddbe966b5d1fe212ada749bc3d0b410f1a7dea74\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e5fd3f514e27db1f05fbd72ba615d74941e23c51\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:55:47+00:00",
      "cve": "CVE-2026-74714",
      "id": "CVE-2026-74714",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74714.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:16:00Z",
      "cve": "CVE-2026-74714",
      "id": "CVE-2026-74714",
      "initial_release_date": "2026-08-23T00:04:08Z",
      "product_status:known_affected": "172",
      "product_status:known_not_affected": "185",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74714",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74714.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.