CVE-2026-74465 Linux CVE debrief

Who should care

Linux kernel users, Open vSwitch users, and security teams responsible for monitoring and patching Linux systems should verify their systems against the affected components and apply patches or mitigations as available. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review.

Technical summary

The Linux kernel's Open vSwitch meter functionality has a use-after-free vulnerability. When attaching a newly created meter, the attach_meter() function makes the new meter visible to other CPUs but can still fail afterwards. On failure, it detaches the meter back and returns an error. However, this is an unexpected behavior for the ovs_meter_cmd_set() that uses a plain kfree(meter) on attach failure without waiting for RCU readers to stop using it, assuming it was never visible. This issue can be triggered with a custom application using the uAPI.

Defensive priority

Linux kernel users should verify their systems against the affected components and apply patches or mitigations as available.

Recommended defensive actions

• Verify system configurations against known affected components.
• Apply patches or mitigations as available.
• Monitor system logs for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record indicates a use-after-free vulnerability in the Linux kernel's Open vSwitch meter functionality. A custom application using the uAPI could trigger the vulnerability. Trend Micro's Zero Day Initiative reported the issue as ZDI-CAN-31642. To verify, defenders should review system configurations, check for affected components, and monitor system logs for suspicious activity.

Official resources