CVE-2026-74750 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel systems, particularly those exposed to network traffic, should assess their exposure and prioritize verifying and applying patches for affected versions.

Why it matters

A vulnerability in the Linux kernel's ovpn component can cause a use-after-free condition when handling key slot crypto freeing, allowing for potential exploitation attempts. Defenders should prioritize verifying and applying patches for affected Linux kernel versions.

• Verify and apply patches for Linux kernel versions affected by this vulnerability
• Monitor network traffic and system logs for potential exploitation attempts
• Implement compensating controls, such as access restrictions and intrusion detection systems

Technical summary

The Linux kernel's ovpn component is vulnerable to a use-after-free condition when handling key slot crypto freeing. This issue arises from the existing release path freeing AEAD transforms from an RCU callback, which is not safe for all crypto implementations. The vulnerability has been resolved by deferring key slot crypto freeing to a workqueue, ensuring that crypto teardown runs in a context where sleeping is allowed.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those exposed to network traffic.

Recommended defensive actions

• Verify Linux kernel versions and apply patches for affected versions
• Monitor network traffic and system logs for potential exploitation attempts
• Implement compensating controls, such as access restrictions and intrusion detection systems
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on this vulnerability. Linux kernel versions 6.16 and earlier are affected, while versions 6.18.57, 7.1.10, and 7.2 are not affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.