CVE-2026-74614

HighCVSS 8.4/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: read virtqueues under worker locks

Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore installs replacement virtqueues. The RX, TX and event workers read their virtqueue before locking and checking the corresponding flag, so a worker delayed across freeze and restore can observe the replacement queue's running state while retaining a pointer to the deleted queue.

Read each virtqueue under its mutex after checking the run flag, keeping the pointer and state in the same queue generation.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 762c251c7f5c4ee5bef71460c6e822ed293fd69f, < 941329ce14c5f481223a10d1d4c8b57ea7f3048a; >= bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c, < 29dd10583bf9d2744cd84b862e4257c0a5699570; >= bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c, < a1fb0c5b8a7c2753758aeced40971f99449dde0c; >= bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c, < eae099c764c7ebdb842eb1f638913e310bdd6513; >= bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c, < bd43a7ec668be428265b3209eb43647aedcf720a; >= bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c, < 1cecb4202afdbeddcf29d59baf596ac6ab753f7f; >= bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c, < ebac8f6b1ef0e9278afe204b8692a7479988dace; >= 5.15.138, < 5.15.216
LinuxLinux5.19

References

Timeline

Published
Aug 22, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-746158.8In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlan_chanCVE-2026-746169.8In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb_shared_info tailroom xdpf_clone() CVE-2026-746179.8In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs->lock in dibs_dev_alloc() dibs->lock is initialiCVE-2026-74618In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't warn when the mount is completed from another user nCVE-2026-74619In the Linux kernel, the following vulnerability has been resolved: ovl: don't warn when the mount is completed from another user namespaceCVE-2026-74626.1The VatanSMS WP SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `page` parameter in all versions up to, andCVE-2026-74620In the Linux kernel, the following vulnerability has been resolved: net/sched: act_gact, act_police: range check the fallback control actioCVE-2026-746217.5In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix sk_buff leak when the header checks reject a pacCVE-2026-74622In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aq_rCVE-2026-74623In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free stranded TX buffers on ring deinit aq_vec_deinit()CVE-2026-746247.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: defer invalid log until after unlock TCP and CVE-2026-746257.5In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftable
CVE-2026-74614: High severity, CVSS 8.4 | Vulnix