Race condition in Linux kernel - CVE-2026-74607
Published: August 24, 2026
Vulnerability identifier: #VU144952
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-74607
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in KVM SVM SEV handling for enc_context_owner and mirror_vms when processing KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM operations. A local user can trigger concurrent VM move, copy, or destroy operations to cause a denial of service.
The issue involves list corruption in mirror VM tracking and incorrect kvm_put_kvm() handling during VM destruction.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-74607
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.105-1
linux (Debian package) - update to 6.12.105-1
External References
- https://git.kernel.org/stable/c/1d78d33275ef2a16c6d080910b291d0a97a0e613
- https://git.kernel.org/stable/c/28afde1edbd8b20058cbf4d75fb57876471ec334
- https://git.kernel.org/stable/c/328ab4fabe05af004d886659f8744076e320ddce
- https://git.kernel.org/stable/c/47976eaaf0a4eb46dade48b3246779090db9e3ec
- https://git.kernel.org/stable/c/7943ec3a6d0e7e0a2eb4943300bce089ac3e8c3e
- https://git.kernel.org/stable/c/d728baba0f20e49439fc7831bf3e4e7dee82161a