Use-after-free in Linux kernel - CVE-2026-74613
Published: August 24, 2026
Vulnerability identifier: #VU144958
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-74613
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in virtio_transport_rx_work in net/vmw_vsock/virtio_transport.c when processing RX work during device teardown. A local user can trigger the vulnerable code path to cause a denial of service.
The issue can lead to a kernel panic during suspend or freeze operations when queued work continues after virtqueues have been deleted.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-74613
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.105-1
linux (Debian package) - update to 6.12.105-1
External References
- https://git.kernel.org/stable/c/1aa21e7c8702a7c37cd7d3cace1a652cfa5e8171
- https://git.kernel.org/stable/c/38c7763fdc533edb34dc8f4489c260e8ba2ccae9
- https://git.kernel.org/stable/c/4d37e3525cc346a1421c1bdeaad5848e249fc60c
- https://git.kernel.org/stable/c/9d80a04129a6c27a690cb69de3fe3f50be5aa8b9
- https://git.kernel.org/stable/c/a309b74e3fc052352ab778500449cb9c3853c363
- https://git.kernel.org/stable/c/a31e0ad444698d8aa7534a0f89fda543730f97a5
- https://git.kernel.org/stable/c/a7658508f5fe8f1077a65e8cb9535d3426f37a2f
- https://git.kernel.org/stable/c/e82a5faea2e3886dfb2a65ce092a132e7e896915