9.8

CVE-2026-74746: linux

CVSS: 9.8v3.1CriticalReceived
AliasesUBUNTU-CVE-2026-74746DEBIAN-CVE-2026-74746
Published 26-08-2026Last modified 16-10-2026
Open JSON

Vulnerability summary

CVE-2026-74746 is a critical (CVSS 9.8) vulnerability in linux. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.54%
0%100%
Low · -0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 13 · Related 1
MGASA-2026-0506RHSA-2026:73645RHSA-2026:74174RHSA-2026:75560RHSA-2026:75746RHSA-2026:75747

Timeline

  1. 26-08-2026
    PublishedVulnerability first disclosed.
  2. 16-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow. KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.54%

Chance of exploitation in the next 30 days

Percentile

44%

Versus all other CVEs

30-day change

-0.01 pp

From 0.54% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.54%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu165 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.187-1 | < 6.12.105-1 | < 7.1.10-1
  • linux-6.12< 6.12.107-1~deb12u1
Linux1 product
  • linux≥ ac2a66665e231847cab11b8c8e844ce43207dd2e, < 0a00254585827f1695aa2700114af622ea754cfa | ≥ ac2a66665e231847cab11b8c8e844ce43207dd2e, < be345dcbddb4643a54252b954af974b16eda8f91 | ≥ ac2a66665e231847cab11b8c8e844ce43207dd2e, < 211ee5d998d92a7d548811939c65942d06c146e4 | ≥ ac2a66665e231847cab11b8c8e844ce43207dd2e, < d37917e7bebe078f3c17e47fd6fc1c9f6e8497b2 | ≥ ac2a66665e231847cab11b8c8e844ce43207dd2e, < 972fdf7c4f5c282a239c88fea614b056c33dc025 | ≥ ac2a66665e231847cab11b8c8e844ce43207dd2e, < d9d3050a70efe217e73a0751e55fdae6a7092620 | ≥ ac2a66665e231847cab11b8c8e844ce43207dd2e, < d16b71231e65cb05daea2b45701fcf09cef041e7 | ≥ ac2a66665e231847cab11b8c8e844ce43207dd2e, < 2014ac62df9d45bb9a004a043e85df7be09ed780 | 4.16

3 vendors · 168 products

References

13 links
Show all 13 references