PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-74613 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's vsock/virtio component. When the RX queue is refilled after teardown, it can lead to a slab-use-after-free error. This issue has been resolved in later kernel versions. The vulnerability was caused by the RX worker refilling the RX queue after teardown, which can cause a use-after-free error. The issue has been addressed by stopping workers during the .remove() process. Linux administrators, security teams, and developers using or maintaining Linux systems, especially those with versions less than the fixed versions, should assess exposure and apply patches.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-22
Original CVE updated
2026-10-16
Advisory published
2026-08-22
Advisory updated
2026-10-16

Who should care

Linux administrators, security teams, and developers using or maintaining Linux systems, especially those with versions less than the fixed versions, should assess exposure and apply patches.

Why it matters

This vulnerability in the Linux kernel's vsock/virtio component can lead to a use-after-free error, potentially causing system instability or crashes. Defenders should verify exposure, apply patches, and monitor systems for potential impacts.

  • Verify Linux kernel versions to determine exposure.
  • Apply patches or updates to prevent potential use-after-free errors.
  • Monitor system logs for exploitation attempts or related errors.

Technical summary

The vulnerability exists in the Linux kernel's vsock/virtio component, where refilling the RX queue after teardown leads to a use-after-free error. This has been addressed in later kernel versions. The issue was caused by the RX worker refilling the RX queue after teardown, which can cause a use-after-free error. The vulnerability can lead to a slab-use-after-free error, potentially causing system instability or crashes. Defenders should verify exposure, apply patches, and monitor systems for potential impacts. The issue has been resolved in later kernel versions.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those with versions less than the fixed versions.

Recommended defensive actions

  • Verify Linux kernel versions in use and compare them to the affected and fixed versions.
  • Apply patches or updates provided by Linux distributions for the affected versions.
  • Monitor system logs for potential exploitation attempts or errors related to vsock/virtio.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was introduced due to refilling the RX queue after teardown, which can cause a use-after-free error. Official sources confirm the issue has been resolved. The CVE record was published on 2026-08-22T15:31:59.062Z and has not been modified since then. The vulnerability exists in the Linux kernel's vsock/virtio component, and defenders should verify exposure, apply patches, and monitor systems for potential impacts. The issue has been addressed in later kernel versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-74613 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-74613

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-74613 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-74613

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • vsock/virtio: avoid refilling the RX queue after teardown

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/74xxx/CVE-2026-74613.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a7658508f5fe8f1077a65e8cb9535d3426f37a2f

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1aa21e7c8702a7c37cd7d3cace1a652cfa5e8171

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4d37e3525cc346a1421c1bdeaad5848e249fc60c

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9d80a04129a6c27a690cb69de3fe3f50be5aa8b9

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a309b74e3fc052352ab778500449cb9c3853c363

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/38c7763fdc533edb34dc8f4489c260e8ba2ccae9

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e82a5faea2e3886dfb2a65ce092a132e7e896915

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.