CVE-2026-74306
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vfio/qat: fix f_pos race in qat_vf_resume_write() qat_vf_resume_write() checks filp->f_pos before taking migf->lock, but copies into the migration-state buffer after taking the lock and re-reading the shared file position. Two concurrent writers could therefore pass the bounds check with the old offset, then have the second writer copy after the first advanced f_pos, writing past the end of the migration-state buffer. Take migf->lock before doing the boundary checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74306
EUVD
EUVD-2026-59453

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition vulnerability in the Linux kernel's vfio/qat driver. It occurs in the qat_vf_resume_write() function where two concurrent writers can write past the end of a migration-state buffer due to improper handling of the file position (f_pos) and missing synchronization.

Detection Guidance

This vulnerability is specific to the Linux kernel's vfio/qat driver and involves a race condition in qat_vf_resume_write(). Detection requires checking kernel logs for related errors or kernel crashes. Commands like dmesg | grep qat or journalctl -k | grep qat may help identify issues. Ensure your kernel version is updated to a patched release.

Impact Analysis

This vulnerability could allow local attackers to corrupt kernel memory, potentially leading to system crashes, privilege escalation, or unauthorized access. It affects systems using the vfio/qat driver for Intel QuickAssist Technology acceleration.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-74306. If immediate patching is not possible, disable the vfio/qat driver module if not required. Monitor kernel logs for signs of exploitation or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74306. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart