8.4

CVE-2026-74614: linux

CVSS: 8.4v3.1HighReceived
AliasesUBUNTU-CVE-2026-74614DEBIAN-CVE-2026-74614
Published 22-08-2026Last modified 16-10-2026
Open JSON

Vulnerability summary

CVE-2026-74614 is a high (CVSS 8.4) vulnerability in linux. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 3.1% of scored vulnerabilities.

Overall risk
34/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.4/10
010
High · v3.1 (CVE.org)
EPSS score
0.14%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 6
MGASA-2026-0506USN-8875-1USN-8875-2USN-8877-1USN-8878-1USN-8879-1

Timeline

  1. 22-08-2026
    PublishedVulnerability first disclosed.
  2. 16-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore installs replacement virtqueues. The RX, TX and event workers read their virtqueue before locking and checking the corresponding flag, so a worker delayed across freeze and restore can observe the replacement queue's running state while retaining a pointer to the deleted queue. Read each virtqueue under its mutex after checking the run flag, keeping the pointer and state in the same queue generation.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.14%

Chance of exploitation in the next 30 days

Percentile

3%

Versus all other CVEs

30-day change

0.00 pp

From 0.14% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.14%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu157 products
  • linux< 5.15.0-198.208 | All versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1117.124 | All versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.187-1 | < 6.12.105-1 | < 7.1.9-1
  • linux-6.12< 6.12.107-1~deb12u1
Linux1 product
  • linux≥ 762c251c7f5c4ee5bef71460c6e822ed293fd69f, < 941329ce14c5f481223a10d1d4c8b57ea7f3048a | ≥ bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c, < 29dd10583bf9d2744cd84b862e4257c0a5699570 | ≥ bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c, < a1fb0c5b8a7c2753758aeced40971f99449dde0c | ≥ bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c, < eae099c764c7ebdb842eb1f638913e310bdd6513 | ≥ bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c, < bd43a7ec668be428265b3209eb43647aedcf720a | ≥ bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c, < 1cecb4202afdbeddcf29d59baf596ac6ab753f7f | ≥ bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c, < ebac8f6b1ef0e9278afe204b8692a7479988dace | ≥ 5.15.138, < 5.15.216 | 5.19

3 vendors · 160 products

References

17 links
Show all 17 references