CVE-2026-74401

CriticalCVSS 9.8/10Last modified Oct 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

dlm: fix add msg handle in send_queue ordered

In a benchmark scenario triggering a lot of requests that triggers a lot of DLM messages on the network it can be that the mh->seq is not ordered according the oldest seq number. This ordering is required by dlm_receive_ack as "before(mh->seq, seq)" will stop to check for older sequence numbers that are ordered in the tail of "node->send_queue".

The side effects of not having it correct ordered regarding "before(mh->seq, seq)" are refcounting issues and use-after free.

I only was able to reproduce this issue in a experimental DLM branch and a user space DLM benchmark that uses io_uring. After changing this I don't experienced any refcounting with the sending buffer issues anymore.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 489d8e559c6596eb08e16447d9830bc39afbe54e, < 482606fea302d8bab86901d7426c3716980d99a8; >= 489d8e559c6596eb08e16447d9830bc39afbe54e, < ae9e534e502a0f48c12baf83608c5de0ff0eab11; >= 489d8e559c6596eb08e16447d9830bc39afbe54e, < 6369619f1b665f12d8c99cc6ff733c64eb08b22e; >= 489d8e559c6596eb08e16447d9830bc39afbe54e, < 712714f818d83373847874ab0f8e426be79296cf; >= 489d8e559c6596eb08e16447d9830bc39afbe54e, < 4d45250b1d22960f86d83245be188b16e456218b; >= 489d8e559c6596eb08e16447d9830bc39afbe54e, < d2248cb70c070f8f04762872772e155b59016f17
LinuxLinux5.14

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 30, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-74402In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix blocking and non-blocking rng logic The blCVE-2026-744037.8In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO SashiCVE-2026-744047.8In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one SashikoCVE-2026-744057.8In the Linux kernel, the following vulnerability has been resolved: OPP: Fix race between OPP addition and lookup A race exists between deCVE-2026-744069.8In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). udCVE-2026-744078.8In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can cCVE-2026-744088.8In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID ath_tx_edCVE-2026-744098.8In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware mac_id in link lookup The maCVE-2026-74416.4The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `posttype` attribute of the `SimpleYearlCVE-2026-744108.1In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA bufCVE-2026-744118.8In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop ACVE-2026-744128.8In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers rtw88 stor
CVE-2026-74401: Critical severity, CVSS 9.8 | Vulnix