CVE-2026-74256 (GCVE-0-2026-74256)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:45
VLAI
Title
bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if (start >= offset + l || last > msg->sg.size) return -EINVAL; can then be passed with an out-of-range start/len, after which the pop loop runs off the end of the scatterlist and sk_msg_shift_left() calls put_page() on the empty msg->sg.end slot: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:sk_msg_shift_left net/core/filter.c:2957 [inline] RIP: 0010:____bpf_msg_pop_data net/core/filter.c:3103 [inline] RIP: 0010:bpf_msg_pop_data+0x753/0x1a10 net/core/filter.c:2984 Call Trace: <TASK> bpf_prog_4cc92c278f4d5d56+0x1b1/0x1e8 bpf_prog_run_pin_on_cpu+0x107/0x320 include/linux/filter.h:746 sk_psock_msg_verdict+0x357/0x7f0 net/core/skmsg.c:934 tcp_bpf_send_verdict net/ipv4/tcp_bpf.c:420 [inline] tcp_bpf_sendmsg+0x766/0x1ae0 net/ipv4/tcp_bpf.c:583 __sock_sendmsg+0x153/0x1c0 net/socket.c:802 __sys_sendto+0x326/0x430 net/socket.c:2265 __x64_sys_sendto+0xe3/0x100 net/socket.c:2268 do_syscall_64+0x14c/0x480 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Widen the addition with a (u64) cast so the bound is evaluated in 64-bit and a len near U32_MAX no longer wraps below msg->sg.size. While here, change pop from int to u32. It counts bytes against the unsigned scatterlist lengths and can never be negative, so the signed type only invites sign-confusion in the pop loop.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 , < 9ef44ed6fb0c1db01cfcc3de432a33e719713eb5 (git)
Affected: 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 , < d693c5ed67dabe1ccbf8dcea93075bdc9ffd4ca0 (git)
Affected: 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 , < ba5cc05dae8fce237d191c7ea96b1107a791e548 (git)
Affected: 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 , < c05a0ec1cdced622a1a0c7d85679fe02f31033ec (git)
Affected: 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 , < 17eb9832a10db2f7a80cb429ca2bc5038445a943 (git)
Affected: 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 , < fe09dd288722f1c749b7506c0b3e7841a7d85027 (git)
Affected: 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 , < e09f7bd7273928b4089e6b71f8e992f2b356ca1b (git)
Affected: 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 , < a48802fb2cd2d1e23651989f8ff4d15e9d5dad54 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.0
Unaffected: 0 , < 5.0 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9ef44ed6fb0c1db01cfcc3de432a33e719713eb5",
              "status": "affected",
              "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
              "versionType": "git"
            },
            {
              "lessThan": "d693c5ed67dabe1ccbf8dcea93075bdc9ffd4ca0",
              "status": "affected",
              "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
              "versionType": "git"
            },
            {
              "lessThan": "ba5cc05dae8fce237d191c7ea96b1107a791e548",
              "status": "affected",
              "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
              "versionType": "git"
            },
            {
              "lessThan": "c05a0ec1cdced622a1a0c7d85679fe02f31033ec",
              "status": "affected",
              "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
              "versionType": "git"
            },
            {
              "lessThan": "17eb9832a10db2f7a80cb429ca2bc5038445a943",
              "status": "affected",
              "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
              "versionType": "git"
            },
            {
              "lessThan": "fe09dd288722f1c749b7506c0b3e7841a7d85027",
              "status": "affected",
              "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
              "versionType": "git"
            },
            {
              "lessThan": "e09f7bd7273928b4089e6b71f8e992f2b356ca1b",
              "status": "affected",
              "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
              "versionType": "git"
            },
            {
              "lessThan": "a48802fb2cd2d1e23651989f8ff4d15e9d5dad54",
              "status": "affected",
              "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check\n\nstart and len are u32, so\n\n\tu64 last = start + len;\n\nevaluates start + len in 32-bit and wraps before storing it in last.\nThe bounds check\n\n\tif (start \u003e= offset + l || last \u003e msg-\u003esg.size)\n\t\treturn -EINVAL;\n\ncan then be passed with an out-of-range start/len, after which the pop\nloop runs off the end of the scatterlist and sk_msg_shift_left() calls\nput_page() on the empty msg-\u003esg.end slot:\n\n  Oops: general protection fault, probably for non-canonical address\n  0xdffffc0000000001: 0000 [#1] SMP KASAN PTI\n  KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n  RIP: 0010:sk_msg_shift_left net/core/filter.c:2957 [inline]\n  RIP: 0010:____bpf_msg_pop_data net/core/filter.c:3103 [inline]\n  RIP: 0010:bpf_msg_pop_data+0x753/0x1a10 net/core/filter.c:2984\n  Call Trace:\n   \u003cTASK\u003e\n   bpf_prog_4cc92c278f4d5d56+0x1b1/0x1e8\n   bpf_prog_run_pin_on_cpu+0x107/0x320 include/linux/filter.h:746\n   sk_psock_msg_verdict+0x357/0x7f0 net/core/skmsg.c:934\n   tcp_bpf_send_verdict net/ipv4/tcp_bpf.c:420 [inline]\n   tcp_bpf_sendmsg+0x766/0x1ae0 net/ipv4/tcp_bpf.c:583\n   __sock_sendmsg+0x153/0x1c0 net/socket.c:802\n   __sys_sendto+0x326/0x430 net/socket.c:2265\n   __x64_sys_sendto+0xe3/0x100 net/socket.c:2268\n   do_syscall_64+0x14c/0x480\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n   \u003c/TASK\u003e\n\nWiden the addition with a (u64) cast so the bound is evaluated in\n64-bit and a len near U32_MAX no longer wraps below msg-\u003esg.size.\n\nWhile here, change pop from int to u32. It counts bytes against the\nunsigned scatterlist lengths and can never be negative, so the signed\ntype only invites sign-confusion in the pop loop."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the BPF sk_msg helper bpf_msg_pop_data(), reached only from the sockmap egress verdict path via local sendmsg/sendto on a sockmap- or kTLS-attached socket (tcp_bpf_sendmsg/tls_sw_sendmsg \u2192 sk_psock_msg_verdict), matching kernel CNA BPF/sockmap Local guidance.\nAC:L - start and len are ARG_ANYTHING (verifier unbounded); an sk_msg program can pick values whose u32 sum wraps below msg-\u003esg.size (e.g. start=100, len\u2248U32_MAX) and trigger the bad path deterministically with a single sendmsg, with no race or external state.\nPR:N - Triggering corruption requires only sendmsg on a socket already in a sockmap whose SK_MSG program calls bpf_msg_pop_data; on internet-facing kTLS/sockmap L7 proxies an unauthenticated remote client can reach this with no victim credentials, and arg2/arg3 are unconstrained by the verifier.\nUI:N - Exploitation needs only the attacker\u0027s own socket traffic and BPF-driven pop parameters; no independent victim mount, file open, or administrator action is required at trigger time.\nS:U - Out-of-bounds scatterlist manipulation corrupts kernel sk_msg/page state within the same kernel security authority and does not by itself cross VM, IOMMU, or hypervisor boundaries.\nC:H - After the overflowed bound check, sk_msg_shift_left() walks past msg-\u003esg.end, reading invalid scatterlist slots and dereferencing bogus page pointers via put_page(), yielding out-of-bounds kernel memory disclosure convertible to arbitrary read.\nI:H - The same over-run writes msg-\u003esg.data[] entries and copy bitmap state beyond the fixed MAX_MSG_FRAGS ring, corrupting adjacent kernel objects with attacker-influenced scatterlist metadata suitable for control-flow hijack and privilege escalation.\nA:H - The fix commit\u0027s KASAN trace shows a general protection fault/null-ptr-deref in sk_msg_shift_left() during bpf_msg_pop_data(); this reliably oopses the host and can panic even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:05.356Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9ef44ed6fb0c1db01cfcc3de432a33e719713eb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/d693c5ed67dabe1ccbf8dcea93075bdc9ffd4ca0"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba5cc05dae8fce237d191c7ea96b1107a791e548"
        },
        {
          "url": "https://git.kernel.org/stable/c/c05a0ec1cdced622a1a0c7d85679fe02f31033ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/17eb9832a10db2f7a80cb429ca2bc5038445a943"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe09dd288722f1c749b7506c0b3e7841a7d85027"
        },
        {
          "url": "https://git.kernel.org/stable/c/e09f7bd7273928b4089e6b71f8e992f2b356ca1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a48802fb2cd2d1e23651989f8ff4d15e9d5dad54"
        }
      ],
      "title": "bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74256",
    "datePublished": "2026-08-15T05:57:34.956Z",
    "dateReserved": "2026-08-15T05:44:03.876Z",
    "dateUpdated": "2026-08-17T05:45:05.356Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74256",
      "date": "2026-09-21",
      "epss": "0.00185",
      "percentile": "0.08321"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/core/filter.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "9ef44ed6fb0c1db01cfcc3de432a33e719713eb5",
                    "status": "affected",
                    "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d693c5ed67dabe1ccbf8dcea93075bdc9ffd4ca0",
                    "status": "affected",
                    "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ba5cc05dae8fce237d191c7ea96b1107a791e548",
                    "status": "affected",
                    "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c05a0ec1cdced622a1a0c7d85679fe02f31033ec",
                    "status": "affected",
                    "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "17eb9832a10db2f7a80cb429ca2bc5038445a943",
                    "status": "affected",
                    "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fe09dd288722f1c749b7506c0b3e7841a7d85027",
                    "status": "affected",
                    "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e09f7bd7273928b4089e6b71f8e992f2b356ca1b",
                    "status": "affected",
                    "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a48802fb2cd2d1e23651989f8ff4d15e9d5dad54",
                    "status": "affected",
                    "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/core/filter.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.0"
                  },
                  {
                    "lessThan": "5.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check\n\nstart and len are u32, so\n\n\tu64 last = start + len;\n\nevaluates start + len in 32-bit and wraps before storing it in last.\nThe bounds check\n\n\tif (start \u003e= offset + l || last \u003e msg-\u003esg.size)\n\t\treturn -EINVAL;\n\ncan then be passed with an out-of-range start/len, after which the pop\nloop runs off the end of the scatterlist and sk_msg_shift_left() calls\nput_page() on the empty msg-\u003esg.end slot:\n\n  Oops: general protection fault, probably for non-canonical address\n  0xdffffc0000000001: 0000 [#1] SMP KASAN PTI\n  KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n  RIP: 0010:sk_msg_shift_left net/core/filter.c:2957 [inline]\n  RIP: 0010:____bpf_msg_pop_data net/core/filter.c:3103 [inline]\n  RIP: 0010:bpf_msg_pop_data+0x753/0x1a10 net/core/filter.c:2984\n  Call Trace:\n   \u003cTASK\u003e\n   bpf_prog_4cc92c278f4d5d56+0x1b1/0x1e8\n   bpf_prog_run_pin_on_cpu+0x107/0x320 include/linux/filter.h:746\n   sk_psock_msg_verdict+0x357/0x7f0 net/core/skmsg.c:934\n   tcp_bpf_send_verdict net/ipv4/tcp_bpf.c:420 [inline]\n   tcp_bpf_sendmsg+0x766/0x1ae0 net/ipv4/tcp_bpf.c:583\n   __sock_sendmsg+0x153/0x1c0 net/socket.c:802\n   __sys_sendto+0x326/0x430 net/socket.c:2265\n   __x64_sys_sendto+0xe3/0x100 net/socket.c:2268\n   do_syscall_64+0x14c/0x480\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n   \u003c/TASK\u003e\n\nWiden the addition with a (u64) cast so the bound is evaluated in\n64-bit and a len near U32_MAX no longer wraps below msg-\u003esg.size.\n\nWhile here, change pop from int to u32. It counts bytes against the\nunsigned scatterlist lengths and can never be negative, so the signed\ntype only invites sign-confusion in the pop loop."
          }
        ],
        "id": "CVE-2026-74256",
        "lastModified": "2026-08-17T06:19:18.920",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:24.743",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/17eb9832a10db2f7a80cb429ca2bc5038445a943"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9ef44ed6fb0c1db01cfcc3de432a33e719713eb5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a48802fb2cd2d1e23651989f8ff4d15e9d5dad54"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ba5cc05dae8fce237d191c7ea96b1107a791e548"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c05a0ec1cdced622a1a0c7d85679fe02f31033ec"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d693c5ed67dabe1ccbf8dcea93075bdc9ffd4ca0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e09f7bd7273928b4089e6b71f8e992f2b356ca1b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fe09dd288722f1c749b7506c0b3e7841a7d85027"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T20:41:08+00:00",
      "cve": "CVE-2026-74256",
      "id": "CVE-2026-74256",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "228",
      "product_status:known_not_affected": "46",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74256.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:24:03Z",
      "cve": "CVE-2026-74256",
      "id": "CVE-2026-74256",
      "initial_release_date": "2026-08-26T01:14:27Z",
      "product_status:known_affected": "269",
      "product_status:known_not_affected": "93",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74256",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74256.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.