CVE-2026-74745 Linux CVE debrief

Who should care

Linux kernel maintainers, system administrators, and users of Linux-based systems should be aware of this vulnerability and take steps to update their systems. System administrators should review and apply the patches provided by the Linux kernel maintainers and update to the latest Linux kernel version that includes the fix. Users of Linux-based systems should also be aware of this vulnerability and take steps to ensure that their systems are up-to-date.

Why it matters

This vulnerability has a CVSS score of 7.5 and is considered HIGH severity. It affects the Linux kernel's bnxt driver and can cause deadlocks when canceling IRQ affinity notifiers. Linux kernel maintainers, system administrators, and users of Linux-based systems should be aware of this vulnerability and take steps to update their systems.

• Potential system crashes or freezes due to deadlocks.
• Increased risk of denial-of-service (DoS) attacks.
• Need for patching and updating Linux kernel versions.

Technical summary

The Linux kernel's bnxt driver has a deadlock vulnerability when canceling IRQ affinity notifiers. The driver takes the netdev instance lock in the notifier to restart the queue and cancels the work under the same lock, which can cause a deadlock. This issue has been resolved by moving the restart to an async service task. The bnxt driver is used in Linux-based systems, and this vulnerability can affect system administrators and users who rely on these systems. The vulnerability has a CVSS score of 7.5 and is considered HIGH severity. To mitigate this vulnerability, it is essential to update to the latest Linux kernel version that includes the fix.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers.
• Update to the latest Linux kernel version that includes the fix.
• Monitor system logs for potential deadlock issues.
• Perform a thorough review of the system configuration to ensure that the bnxt driver is properly configured.
• Implement compensating controls, such as additional monitoring or logging, to detect potential deadlock issues.
• Conduct a thorough asset inventory to identify all systems that may be affected by this vulnerability.
• Schedule regular security updates and patches for all Linux kernel versions.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description, affected versions, and references to source code changes. However, there is limited information about potential exploits or attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.