CVE-2026-74662
Received Received - Intake

Fragment Queue Timer Issue in Linux Kernel

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74662
EUVD
EUVD-2026-64349

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the fragment queue timer. The timer is armed before the queue is published in the hash table. If the timeout is zero or negative, the timer may run before the queue is visible, causing the timer callback to mark the queue complete prematurely. This leads to a missing hash reference and a stale hash node after cleanup.

Detection Guidance

This vulnerability is specific to the Linux kernel's inet fragmentation handling. Detection requires checking kernel versions and configuration. Use uname -a to check kernel version and sysctl net.inet.ip.frag.time to verify fragment timeout settings. If the timeout is zero or negative, the system may be vulnerable.

Impact Analysis

This could cause system instability or crashes due to memory corruption or use-after-free issues. Attackers might exploit it to trigger denial-of-service conditions or execute arbitrary code with kernel privileges.

Mitigation Strategies

Apply the latest kernel update from your distribution to patch the inet_frag_create() vulnerability. Ensure fragment timeout values are positive by setting sysctl net.inet.ip.frag.time to a valid positive integer. Monitor for crashes or instability in network services after applying changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74662. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart