CVE-2026-74614

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore installs replacement virtqueues. The RX, TX and event workers read their virtqueue before locking and checking the corresponding flag, so a worker delayed across freeze and restore can observe the replacement queue's running state while retaining a pointer to the deleted queue. Read each virtqueue under its mutex after checking the run flag, keeping the pointer and state in the same queue generation.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/1cecb4202afdbeddcf29d59baf596ac6ab753f7f
https://git.kernel.org/stable/c/29dd10583bf9d2744cd84b862e4257c0a5699570
https://git.kernel.org/stable/c/941329ce14c5f481223a10d1d4c8b57ea7f3048a
https://git.kernel.org/stable/c/a1fb0c5b8a7c2753758aeced40971f99449dde0c
https://git.kernel.org/stable/c/bd43a7ec668be428265b3209eb43647aedcf720a
https://git.kernel.org/stable/c/eae099c764c7ebdb842eb1f638913e310bdd6513
https://git.kernel.org/stable/c/ebac8f6b1ef0e9278afe204b8692a7479988dace

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-22 16:16

Updated : 2026-08-25 06:18

NVD link : CVE-2026-74614

Mitre link : CVE-2026-74614

CVE.ORG link : CVE-2026-74614

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-74614", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "762c251c7f5c4ee5bef71460c6e822ed293fd69f", "lessThan": "941329ce14c5f481223a10d1d4c8b57ea7f3048a", "versionType": "git"}, {"status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "29dd10583bf9d2744cd84b862e4257c0a5699570", "versionType": "git"}, {"status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "a1fb0c5b8a7c2753758aeced40971f99449dde0c", "versionType": "git"}, {"status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "eae099c764c7ebdb842eb1f638913e310bdd6513", "versionType": "git"}, {"status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "bd43a7ec668be428265b3209eb43647aedcf720a", "versionType": "git"}, {"status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "1cecb4202afdbeddcf29d59baf596ac6ab753f7f", "versionType": "git"}, {"status": "affected", "version": "bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c", "lessThan": "ebac8f6b1ef0e9278afe204b8692a7479988dace", "versionType": "git"}, {"status": "affected", "version": "5.15.138", "lessThan": "5.15.216", "versionType": "semver"}], "programFiles": ["net/vmw_vsock/virtio_transport.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"status": "unaffected", "version": "0", "lessThan": "5.19", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/vmw_vsock/virtio_transport.c"], "defaultStatus": "affected"}]}], "published": "2026-08-22T16:16:34.023", "references": [{"url": "https://git.kernel.org/stable/c/1cecb4202afdbeddcf29d59baf596ac6ab753f7f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/29dd10583bf9d2744cd84b862e4257c0a5699570", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/941329ce14c5f481223a10d1d4c8b57ea7f3048a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a1fb0c5b8a7c2753758aeced40971f99449dde0c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bd43a7ec668be428265b3209eb43647aedcf720a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/eae099c764c7ebdb842eb1f638913e310bdd6513", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ebac8f6b1ef0e9278afe204b8692a7479988dace", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: read virtqueues under worker locks\n\nCommit bd50c5dc182b (\"vsock/virtio: add support for device\nsuspend/resume\") made the *_run flags transition from false to true when\nrestore installs replacement virtqueues. The RX, TX and event workers\nread their virtqueue before locking and checking the corresponding flag,\nso a worker delayed across freeze and restore can observe the replacement\nqueue's running state while retaining a pointer to the deleted queue.\n\nRead each virtqueue under its mutex after checking the run flag, keeping\nthe pointer and state in the same queue generation."}], "lastModified": "2026-08-25T06:18:39.263", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}