CVE-2026-74675 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should assess their exposure and apply the patch or update to a fixed version.

Why it matters

CVE-2026-74675 is a Linux kernel vulnerability that could allow local attackers to escalate privileges. It arises from a race condition in the vt subsystem, specifically in the kbd_keycode function. Linux kernel developers, maintainers, and users should assess exposure and apply patches or updates to prevent exploitation.

• Local privilege escalation is possible if an attacker can trigger the race condition.
• System crashes or instability may occur if the vulnerability is exploited.
• Verification of affected versions and application of patches is necessary to prevent exploitation.
• Monitoring system logs for potential exploitation attempts is recommended.

Technical summary

The vulnerability is caused by a race condition in the vt subsystem, specifically in the kbd_keycode function. This function reads vc->port.tty without acquiring a tty reference, which can lead to a use-after-free vulnerability when con_shutdown() clears port.tty under a different lock. The fix involves using tty_port_tty_get()/tty_kref_put() to hold a proper reference for the duration the tty pointer is needed.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch provided by the Linux kernel maintainers.
• Update Linux kernel to a version that includes the fix.
• Monitor system logs for potential exploitation attempts.
• Perform a thorough review of system configurations and apply compensating controls if necessary.
• Verify the integrity of affected systems and ensure that all necessary patches are applied.
• Track exceptions and retest remediated assets to ensure that the vulnerability is fully resolved.
• Conduct a comprehensive asset inventory to identify all affected systems and prioritize remediation efforts.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description and affected versions. However, the corpus does not establish specific exploitation or impact details, requiring verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.