Improper resource shutdown or release in Linux kernel - CVE-2026-74718
Published: August 24, 2026
Vulnerability identifier: #VU144617
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-74718
CWE-ID: CWE-404
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in devlink_nl_reload_doit() when handling a devlink reload request that targets a different network namespace with an action other than DRIVER_REINIT. A local user can send a specially crafted devlink reload request to cause a denial of service.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-74718
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.105-1
linux (Debian package) - update to 6.12.105-1
External References
- https://git.kernel.org/stable/c/1c4dac9bf1d2ac31da63b794bdec697777cbd0fd
- https://git.kernel.org/stable/c/7b02c6d2a3cd2cd669f5c16685779f84328ae60c
- https://git.kernel.org/stable/c/7b6552e53426ea0539c667bbc5a524fdf7feae6f
- https://git.kernel.org/stable/c/bf0797b92be591ac71d7c0f610e695caca3c72c9
- https://git.kernel.org/stable/c/eda60c85b4f4c7d66b7141a5fe020b1a7f395341