CVE-2026-74575 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should care about this vulnerability. The affected operator is the Linux kernel community. The platform impact is on Linux-based systems. The vulnerability-management impact is high priority due to the HIGH CVSS score of 8.8 and potential for use-after-free attacks. The security-team impact is also high priority due to the potential for an attacker to execute arbitrary code or cause a denial of service.

Technical summary

The CVE-2026-74575 vulnerability in the Linux kernel is a use-after-free vulnerability in the thunderbolt subsystem. The vulnerability is caused by a race condition between the tb_xdp_handle_request() function and the tb_xdomain_remove() function. This allows an attacker to potentially execute arbitrary code or cause a denial of service. The affected product context is the Linux kernel. The defensive impact is high priority due to the HIGH CVSS score of 8.8 and potential for use-after-free attacks.

Defensive priority

High priority due to the HIGH CVSS score of 8.8 and potential for use-after-free attacks.

Recommended defensive actions

• Apply the patch from the Linux kernel repository to fix the use-after-free vulnerability.
• Review and update Linux kernel installations to ensure the patched version is deployed.
• Monitor system logs for potential exploitation attempts.
• Perform thorough vulnerability scanning to identify potentially affected systems.
• Isolate affected systems from the network to prevent exploitation.
• Implement additional monitoring to detect potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE-2026-74575 vulnerability in the Linux kernel has been resolved. The issue is related to a use-after-free vulnerability in the thunderbolt subsystem. The vulnerability is caused by a race condition between the tb_xdp_handle_request() function and the tb_xdomain_remove() function. Evidence is based on official CVE and NVD records, as well as source references from the Linux kernel repository.

Official resources