CVE-2026-74614
Received Received - Intake

Linux Kernel vsock VirtIO Use-After-Free

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore installs replacement virtqueues. The RX, TX and event workers read their virtqueue before locking and checking the corresponding flag, so a worker delayed across freeze and restore can observe the replacement queue's running state while retaining a pointer to the deleted queue. Read each virtqueue under its mutex after checking the run flag, keeping the pointer and state in the same queue generation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74614
EUVD
EUVD-2026-64551

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the vsock/virtio driver. When the system resumes from suspend, replacement virtqueues are installed but workers may read the new queue's state while still holding a pointer to the old, deleted queue. This happens because workers check the run flag before locking, leading to potential use-after-free scenarios.

Detection Guidance

This vulnerability is specific to the Linux kernel's vsock/virtio implementation. Detection requires checking kernel logs for errors related to virtqueue operations or device suspend/resume failures. Commands like dmesg | grep virtio or journalctl -k | grep vsock may help identify issues.

Impact Analysis

This could allow an attacker with local access to cause a kernel crash or execute arbitrary code in the kernel context. It may lead to denial of service, privilege escalation, or data corruption on affected systems running vulnerable Linux kernel versions.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. Monitor kernel security advisories and apply updates promptly. If immediate patching is not possible, consider disabling vsock/virtio features if they are not critical to your system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74614. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart