CVE-2026-74689 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of Linux-based systems, should be aware of this vulnerability and take steps to ensure their systems are patched. This includes reviewing the provided source code changes, verifying the Linux kernel version, and updating to a patched version if necessary. Additionally, system administrators and security teams should monitor system logs for potential exploitation attempts and review compensating for

Why it matters

This vulnerability in the Linux kernel's net/atm subsystem can lead to a slab-out-of-bounds read, potentially causing denial-of-service or information disclosure. Linux kernel developers and users should take steps to ensure their systems are patched.

• Potential denial-of-service (DoS) due to slab-out-of-bounds read
• Possible information disclosure due to unauthorized access to sensitive data
• Elevation of privileges may be possible if exploited in conjunction with other vulnerabilities

Technical summary

The vcc_setsockopt() function in the Linux kernel's net/atm subsystem contains an ineffective optlen check. This can lead to a KASAN slab-out-of-bounds read when optlen is smaller than the expected structure size. The issue is resolved by using copy_safe_from_sockptr(), which validates that optlen is at least the expected size before copying. The fix changes the local 'value' variable type from 'unsigned long' to 'int' so that SO_SETCLP matches its sizeof(int) ABI encoding on 64-bit systems. The vulnerability has a CVSS score of 7.1 and is considered HIGH severity.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided source code changes to ensure the vulnerability is patched
• Verify the Linux kernel version and update to a patched version if necessary
• Monitor system logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description, affected versions, and references to source code changes. The issue is related to the Linux kernel's net/atm subsystem and the vcc_setsockopt() function. The fix involves using copy_safe_from_sockptr() to validate optlen. The vulnerability has been assigned a CVSS score of 7.1 and is considered HIGH severity. The CVE record was published on 2026-08-22T15:32:54.034Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.