CVE-2026-74310 (GCVE-0-2026-74310)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:45
VLAI
Title
vhost/net: complete zerocopy ubufs only once
Summary
In the Linux kernel, the following vulnerability has been resolved: vhost/net: complete zerocopy ubufs only once vhost-net initializes one ubuf_info per outstanding zerocopy TX descriptor and hands it to the backend socket. The networking stack may then clone a zerocopy skb before all skb references are released. For example, batman-adv fragmentation reaches skb_split(), which calls skb_zerocopy_clone() and increments the same ubuf_info refcount. vhost_zerocopy_complete() currently treats every ubuf callback as a completed vhost descriptor. It dereferences ubuf->ctx, writes the descriptor completion state, and drops the vhost_net_ubuf_ref even when the callback only releases a cloned skb reference. A backend reset can therefore wait for and free the vhost_net_ubuf_ref while another cloned skb still carries the same ubuf_info. A later completion then dereferences the freed ubufs pointer. KASAN reports the stale completion as: BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7/0x1f0 BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x101/0x1f0 vhost_zerocopy_complete skb_copy_ubufs __dev_forward_skb2 veth_xmit The freed object was allocated from vhost_net_ioctl() while setting the backend and freed through kfree_rcu()/kvfree_rcu_bulk after backend removal, while delayed skb completion still reached vhost_zerocopy_complete(). Honor the generic ubuf_info refcount before touching vhost state, and run the vhost descriptor completion only for the final ubuf reference. This matches the msg_zerocopy_complete() ownership rule for cloned zerocopy skbs.
Severity
9.3 (Critical)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bab632d69ee48a106e779b60cc01adfe80a72807 , < ea71f873423fb73e66ad88936d6759ac0ad4aa53 (git)
Affected: bab632d69ee48a106e779b60cc01adfe80a72807 , < 6445b945024f4c7675ae5352b2d5885cb1deea71 (git)
Affected: bab632d69ee48a106e779b60cc01adfe80a72807 , < a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d (git)
Affected: bab632d69ee48a106e779b60cc01adfe80a72807 , < 321c73baf54d971ce3771fea275c98a247f7ee35 (git)
Affected: bab632d69ee48a106e779b60cc01adfe80a72807 , < c069437924663539a93a1e5afe90838d9ccee284 (git)
Affected: bab632d69ee48a106e779b60cc01adfe80a72807 , < 8f6898fe80794f2d7c3d38c1158c806e4074a1c4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.1
Unaffected: 0 , < 3.1 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vhost/net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea71f873423fb73e66ad88936d6759ac0ad4aa53",
              "status": "affected",
              "version": "bab632d69ee48a106e779b60cc01adfe80a72807",
              "versionType": "git"
            },
            {
              "lessThan": "6445b945024f4c7675ae5352b2d5885cb1deea71",
              "status": "affected",
              "version": "bab632d69ee48a106e779b60cc01adfe80a72807",
              "versionType": "git"
            },
            {
              "lessThan": "a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d",
              "status": "affected",
              "version": "bab632d69ee48a106e779b60cc01adfe80a72807",
              "versionType": "git"
            },
            {
              "lessThan": "321c73baf54d971ce3771fea275c98a247f7ee35",
              "status": "affected",
              "version": "bab632d69ee48a106e779b60cc01adfe80a72807",
              "versionType": "git"
            },
            {
              "lessThan": "c069437924663539a93a1e5afe90838d9ccee284",
              "status": "affected",
              "version": "bab632d69ee48a106e779b60cc01adfe80a72807",
              "versionType": "git"
            },
            {
              "lessThan": "8f6898fe80794f2d7c3d38c1158c806e4074a1c4",
              "status": "affected",
              "version": "bab632d69ee48a106e779b60cc01adfe80a72807",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vhost/net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost/net: complete zerocopy ubufs only once\n\nvhost-net initializes one ubuf_info per outstanding zerocopy TX\ndescriptor and hands it to the backend socket.  The networking stack may\nthen clone a zerocopy skb before all skb references are released.  For\nexample, batman-adv fragmentation reaches skb_split(), which calls\nskb_zerocopy_clone() and increments the same ubuf_info refcount.\n\nvhost_zerocopy_complete() currently treats every ubuf callback as a\ncompleted vhost descriptor.  It dereferences ubuf-\u003ectx, writes the\ndescriptor completion state, and drops the vhost_net_ubuf_ref even when\nthe callback only releases a cloned skb reference.  A backend reset can\ntherefore wait for and free the vhost_net_ubuf_ref while another cloned\nskb still carries the same ubuf_info.  A later completion then\ndereferences the freed ubufs pointer.\n\nKASAN reports the stale completion as:\n\n  BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7/0x1f0\n  BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x101/0x1f0\n  vhost_zerocopy_complete\n  skb_copy_ubufs\n  __dev_forward_skb2\n  veth_xmit\n\nThe freed object was allocated from vhost_net_ioctl() while setting the\nbackend and freed through kfree_rcu()/kvfree_rcu_bulk after backend\nremoval, while delayed skb completion still reached\nvhost_zerocopy_complete().\n\nHonor the generic ubuf_info refcount before touching vhost state, and run\nthe vhost descriptor completion only for the final ubuf reference.  This\nmatches the msg_zerocopy_complete() ownership rule for cloned zerocopy\nskbs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is only reachable on the vhost-net TX zerocopy path via /dev/vhost-net ioctls or virtio-net TX descriptors handled by the host vhost worker; remote wire packets do not carry vhost ubuf_info state, so no network-facing host protocol reaches vhost_zerocopy_complete().\nAC:L - Once experimental_zcopytx is enabled, an attacker can reliably send \u003e=256-byte zerocopy TX frames through a tap/veth backend so skb_zerocopy_clone/skb_copy_ubufs fires, then force backend teardown via VHOST_NET_SET_BACKEND or VM stop/migration while cloned completions remain pending.\nPR:N - A malicious KVM guest on a host using vhost-net needs no host root, capabilities, or /dev/vhost-net access\u2014only control of virtio TX descriptors and normal VM networking; a host-side attacker can also open /dev/vhost-net with only device-node permissions because drivers/vhost performs no capable() checks.\nUI:N - No victim user interaction is required beyond standard VM or vhost-net operation; the attacker directly drives virtio TX traffic, optional veth forwarding that clones zerocopy skbs, and backend reset/teardown that frees vhost_net_ubuf_ref while stale ubuf completions are still outstanding.\nS:C - In the standard KVM deployment, vhost-net is host-kernel code enforcing the guest NIC boundary; the slab use-after-free in vhost_zerocopy_complete executes in host context from guest-supplied zerocopy TX, corrupting host vhost/virtqueue state outside the guest security authority.\nC:H - This is a slab use-after-free: after premature completion frees vhost_net_ubuf_ref, a later skb_zcopy_clear callback dereferences freed ubuf-\u003ectx/ubufs memory in vhost_zerocopy_complete, giving attacker-influenced UAF primitives suitable for arbitrary kernel memory disclosure.\nI:H - The stale completion writes vq-\u003eheads[ubuf-\u003edesc].len and decrements vhost_net_ubuf_ref on freed structures; UAF heap corruption of this class is leveragable into arbitrary write and host control-flow hijacking, including potential VM-to-host privilege escalation.\nA:H - KASAN reports slab-use-after-free in vhost_zerocopy_complete during skb_copy_ubufs/veth_xmit completion; this readily causes host kernel oops or panic and can be retriggered from a virtio guest TX loop or repeated backend resets until the host or hypervisor is unavailable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:42.723Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ea71f873423fb73e66ad88936d6759ac0ad4aa53"
        },
        {
          "url": "https://git.kernel.org/stable/c/6445b945024f4c7675ae5352b2d5885cb1deea71"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/321c73baf54d971ce3771fea275c98a247f7ee35"
        },
        {
          "url": "https://git.kernel.org/stable/c/c069437924663539a93a1e5afe90838d9ccee284"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f6898fe80794f2d7c3d38c1158c806e4074a1c4"
        }
      ],
      "title": "vhost/net: complete zerocopy ubufs only once",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74310",
    "datePublished": "2026-08-15T05:58:10.043Z",
    "dateReserved": "2026-08-15T05:44:03.883Z",
    "dateUpdated": "2026-08-17T05:45:42.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74310",
      "date": "2026-09-20",
      "epss": "0.00138",
      "percentile": "0.03539"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/vhost/net.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ea71f873423fb73e66ad88936d6759ac0ad4aa53",
                    "status": "affected",
                    "version": "bab632d69ee48a106e779b60cc01adfe80a72807",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6445b945024f4c7675ae5352b2d5885cb1deea71",
                    "status": "affected",
                    "version": "bab632d69ee48a106e779b60cc01adfe80a72807",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d",
                    "status": "affected",
                    "version": "bab632d69ee48a106e779b60cc01adfe80a72807",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "321c73baf54d971ce3771fea275c98a247f7ee35",
                    "status": "affected",
                    "version": "bab632d69ee48a106e779b60cc01adfe80a72807",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c069437924663539a93a1e5afe90838d9ccee284",
                    "status": "affected",
                    "version": "bab632d69ee48a106e779b60cc01adfe80a72807",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8f6898fe80794f2d7c3d38c1158c806e4074a1c4",
                    "status": "affected",
                    "version": "bab632d69ee48a106e779b60cc01adfe80a72807",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/vhost/net.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.1"
                  },
                  {
                    "lessThan": "3.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost/net: complete zerocopy ubufs only once\n\nvhost-net initializes one ubuf_info per outstanding zerocopy TX\ndescriptor and hands it to the backend socket.  The networking stack may\nthen clone a zerocopy skb before all skb references are released.  For\nexample, batman-adv fragmentation reaches skb_split(), which calls\nskb_zerocopy_clone() and increments the same ubuf_info refcount.\n\nvhost_zerocopy_complete() currently treats every ubuf callback as a\ncompleted vhost descriptor.  It dereferences ubuf-\u003ectx, writes the\ndescriptor completion state, and drops the vhost_net_ubuf_ref even when\nthe callback only releases a cloned skb reference.  A backend reset can\ntherefore wait for and free the vhost_net_ubuf_ref while another cloned\nskb still carries the same ubuf_info.  A later completion then\ndereferences the freed ubufs pointer.\n\nKASAN reports the stale completion as:\n\n  BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7/0x1f0\n  BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x101/0x1f0\n  vhost_zerocopy_complete\n  skb_copy_ubufs\n  __dev_forward_skb2\n  veth_xmit\n\nThe freed object was allocated from vhost_net_ioctl() while setting the\nbackend and freed through kfree_rcu()/kvfree_rcu_bulk after backend\nremoval, while delayed skb completion still reached\nvhost_zerocopy_complete().\n\nHonor the generic ubuf_info refcount before touching vhost state, and run\nthe vhost descriptor completion only for the final ubuf reference.  This\nmatches the msg_zerocopy_complete() ownership rule for cloned zerocopy\nskbs."
          }
        ],
        "id": "CVE-2026-74310",
        "lastModified": "2026-08-17T06:19:25.200",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:30.987",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/321c73baf54d971ce3771fea275c98a247f7ee35"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6445b945024f4c7675ae5352b2d5885cb1deea71"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8f6898fe80794f2d7c3d38c1158c806e4074a1c4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c069437924663539a93a1e5afe90838d9ccee284"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ea71f873423fb73e66ad88936d6759ac0ad4aa53"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-20T16:57:35+00:00",
      "cve": "CVE-2026-74310",
      "id": "CVE-2026-74310",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:under_investigation": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vhost/net: complete zerocopy ubufs only once",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74310.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:23:07Z",
      "cve": "CVE-2026-74310",
      "id": "CVE-2026-74310",
      "initial_release_date": "2026-08-27T00:22:51Z",
      "product_status:known_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74310",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74310.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.