CVE-2026-74699

Not scored yetLast modified Oct 14, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix memory leak in exec_queue_set_hang_replay_state()

The q->replay_state is blindly overwritten, which can potentially leak memory that was previously allocated by vmemdup_user(). Return an error if q->replay_state is not empty.

Discovered using AI-assisted static analysis confirmed by Intel Product Security.

(cherry picked from commit f6b6cc1118bdbc4265fa8b3bdf8565b26f13e56e)

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 1026c1a73a9686ff35ac100039f94f0725622447, < 410596743958fbddeb845ff3efe2645397d7c7e2; >= 1026c1a73a9686ff35ac100039f94f0725622447, < c5f500161709f27719701334190dff2325868ef0
LinuxLinux7.0

References

Timeline

Published
Aug 22, 2026
Last modified
Oct 14, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-74708.8A flaw has been found in Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01. Affected is the function sub_427C3C of the file /goform/SafeMacFilterCVE-2026-747007.8In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Always acquire rtnl_lock when destroying locked claCVE-2026-747017.8In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in key_extract() When a CVE-2026-747028.8In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhost_scsi_setup_vq_CVE-2026-747037.1In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Validate T10 PI scatterlist counts When T10 PI is negotiatCVE-2026-747048.2In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filteCVE-2026-7470510.0In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation __skb_udp_tunCVE-2026-74706In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocationCVE-2026-747077.8In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path valCVE-2026-747087.8In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends bCVE-2026-74709In the Linux kernel, the following vulnerability has been resolved: xsk: clear metadata pointer when no timestamp is requested User space CVE-2026-74713.5GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 t
CVE-2026-74699: Unscored | Vulnix