{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74614", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.920Z", "datePublished": "2026-08-22T15:31:59.800Z", "dateUpdated": "2026-08-25T05:40:40.984Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:40.984Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: read virtqueues under worker locks\n\nCommit bd50c5dc182b (\"vsock/virtio: add support for device\nsuspend/resume\") made the *_run flags transition from false to true when\nrestore installs replacement virtqueues. The RX, TX and event workers\nread their virtqueue before locking and checking the corresponding flag,\nso a worker delayed across freeze and restore can observe the replacement\nqueue's running state while retaining a pointer to the deleted queue.\n\nRead each virtqueue under its mutex after checking the run flag, keeping\nthe pointer and state in the same queue generation."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in the guest virtio-vsock driver reached via AF_VSOCK sockets and virtio virtqueue completions, not via routable network protocols; per kernel CNA guidance vsock and virtio guest-driver bugs are scored Local even when the hypervisor is the peer.\nAC:L - An attacker or malicious host controls both sides of the race by flooding vsock/virtqueue traffic to queue RX/TX/event workers while virtio_vsock_freeze/restore deletes and replaces virtqueues, making the stale pre-lock virtqueue pointer race reliable and repeatable.\nPR:N - No guest privileges are required in the highest-impact scenario: a malicious hypervisor or host-initiated suspend/migrate triggers freeze/restore while virtio completions queue workers, matching confidential-computing models where the host is untrusted and holds no guest credentials.\nUI:N - Vulnerable RX/TX/event workers run automatically from virtqueue IRQ callbacks on a dedicated workqueue; no victim must mount filesystems, open files, or take deliberate action beyond normal virtio-vsock device operation and VM lifecycle events.\nS:U - Corruption is confined to the guest kernel virtio-vsock driver; exploited impact stays within the guest security boundary and does not cross to the hypervisor (guest-to-host escape would involve vhost-vsock on the host, not this guest-side driver).\nC:H - Use-after-free of a deleted virtqueue: virtqueue_disable_cb, virtqueue_get_buf, and virtqueue_enable_cb dereference freed vring_virtqueue slab memory, enabling attacker-controlled reuse and arbitrary kernel memory disclosure typical of virtio UAF bugs.\nI:H - Corrupted virtqueue metadata permits out-of-bounds ring/index manipulation and further virtqueue operations, furnishing heap corruption and arbitrary-write primitives suitable for guest ring-0 code execution and privilege escalation.\nA:H - Operating on freed virtqueues triggers KASAN slab-use-after-free and kernel BUG/oops/panic (as in the related virtio-vsock freeze bug CVE-2026-74613), fully denying guest availability even when full exploitation is not attempted."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/vmw_vsock/virtio_transport.c"], "versions": [{"version": "762c251c7f5c4ee5bef71460c6e822ed293fd69f", "lessThan": "941329ce14c5f481223a10d1d4c8b57ea7f3048a", "status": "affected", "versionType": "git"}, {"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "29dd10583bf9d2744cd84b862e4257c0a5699570", "status": "affected", "versionType": "git"}, {"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "a1fb0c5b8a7c2753758aeced40971f99449dde0c", "status": "affected", "versionType": "git"}, {"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "eae099c764c7ebdb842eb1f638913e310bdd6513", "status": "affected", "versionType": "git"}, {"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "bd43a7ec668be428265b3209eb43647aedcf720a", "status": "affected", "versionType": "git"}, {"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "1cecb4202afdbeddcf29d59baf596ac6ab753f7f", "status": "affected", "versionType": "git"}, {"version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "ebac8f6b1ef0e9278afe204b8692a7479988dace", "status": "affected", "versionType": "git"}, {"version": "5.15.138", "lessThan": "5.15.216", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/vmw_vsock/virtio_transport.c"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.138", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/941329ce14c5f481223a10d1d4c8b57ea7f3048a"}, {"url": "https://git.kernel.org/stable/c/29dd10583bf9d2744cd84b862e4257c0a5699570"}, {"url": "https://git.kernel.org/stable/c/a1fb0c5b8a7c2753758aeced40971f99449dde0c"}, {"url": "https://git.kernel.org/stable/c/eae099c764c7ebdb842eb1f638913e310bdd6513"}, {"url": "https://git.kernel.org/stable/c/bd43a7ec668be428265b3209eb43647aedcf720a"}, {"url": "https://git.kernel.org/stable/c/1cecb4202afdbeddcf29d59baf596ac6ab753f7f"}, {"url": "https://git.kernel.org/stable/c/ebac8f6b1ef0e9278afe204b8692a7479988dace"}], "title": "vsock/virtio: read virtqueues under worker locks", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/vmw_vsock/virtio_transport.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "941329ce14c5f481223a10d1d4c8b57ea7f3048a", "status": "affected", "version": "762c251c7f5c4ee5bef71460c6e822ed293fd69f", "versionType": "git"}, {"lessThan": "29dd10583bf9d2744cd84b862e4257c0a5699570", "status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "versionType": "git"}, {"lessThan": "a1fb0c5b8a7c2753758aeced40971f99449dde0c", "status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "versionType": "git"}, {"lessThan": "eae099c764c7ebdb842eb1f638913e310bdd6513", "status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "versionType": "git"}, {"lessThan": "bd43a7ec668be428265b3209eb43647aedcf720a", "status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "versionType": "git"}, {"lessThan": "1cecb4202afdbeddcf29d59baf596ac6ab753f7f", "status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "versionType": "git"}, {"lessThan": "ebac8f6b1ef0e9278afe204b8692a7479988dace", "status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "versionType": "git"}, {"lessThan": "5.15.216", "status": "affected", "version": "5.15.138", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/vmw_vsock/virtio_transport.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: read virtqueues under worker locks\n\nCommit bd50c5dc182b (\"vsock/virtio: add support for device\nsuspend/resume\") made the *_run flags transition from false to true when\nrestore installs replacement virtqueues. The RX, TX and event workers\nread their virtqueue before locking and checking the corresponding flag,\nso a worker delayed across freeze and restore can observe the replacement\nqueue's running state while retaining a pointer to the deleted queue.\n\nRead each virtqueue under its mutex after checking the run flag, keeping\nthe pointer and state in the same queue generation."}], "id": "CVE-2026-74614", "lastModified": "2026-08-25T06:18:39.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-22T16:16:34.023", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1cecb4202afdbeddcf29d59baf596ac6ab753f7f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/29dd10583bf9d2744cd84b862e4257c0a5699570"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/941329ce14c5f481223a10d1d4c8b57ea7f3048a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a1fb0c5b8a7c2753758aeced40971f99449dde0c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bd43a7ec668be428265b3209eb43647aedcf720a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eae099c764c7ebdb842eb1f638913e310bdd6513"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ebac8f6b1ef0e9278afe204b8692a7479988dace"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: vsock/virtio: read virtqueues under worker locks", "id": "2521402", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521402"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-820", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvsock/virtio: read virtqueues under worker locks\nCommit bd50c5dc182b (\"vsock/virtio: add support for device\nsuspend/resume\") made the *_run flags transition from false to true when\nrestore installs replacement virtqueues. The RX, TX and event workers\nread their virtqueue before locking and checking the corresponding flag,\nso a worker delayed across freeze and restore can observe the replacement\nqueue's running state while retaining a pointer to the deleted queue.\nRead each virtqueue under its mutex after checking the run flag, keeping\nthe pointer and state in the same queue generation.", "A flaw was found in the Linux kernel's `vsock/virtio` component. During system suspend and resume operations, a worker process might incorrectly retain a pointer to a deleted virtual queue while observing a replacement queue's running state. This inconsistent state can lead to system instability or a denial of service."], "name": "CVE-2026-74614", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74614\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74614\nhttps://lore.kernel.org/linux-cve-announce/2026082218-CVE-2026-74614-b5a1@gregkh/T"], "threat_severity": "Moderate"}