CVE-2026-74321 (GCVE-0-2026-74321)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:45
VLAI
Title
btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() In the beginning of the loop, we try to obtain a locked delayed ref head, if 'locked_ref' is currently NULL, by calling btrfs_select_ref_head(), which can return an error pointer. If the error pointer is -EAGAIN we do a continue and go back to the beginning of the loop, which will not try again to call btrfs_select_ref_head() since 'locked_ref' is no longer NULL but it's ERR_PTR(-EAGAIN), and then we do: spin_lock(&locked_ref->lock); against a ERR_PTR(-EAGAIN) value, generating an invalid pointer dereference. Fix this by ensuring that 'locked_ref' is set to NULL when btrfs_select_ref_head() returns ERR_PTR(-EAGAIN) and incrementing 'count' as well, to prevent infinite looping. We do this by doing a goto to the bottom of the loop that already sets 'locked_ref' to NULL and does a cond_resched(), with an increment to 'count' right before the goto. These measures were in place before the refactoring in commit 0110a4c43451 ("btrfs: refactor __btrfs_run_delayed_refs loop") but were unintentionally lost afterwards.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0110a4c43451533de1ea1bbdc57b5d452f9d8b25 , < c372ca227e16bace86f1df1fa4ae6849e2fcfa28 (git)
Affected: 0110a4c43451533de1ea1bbdc57b5d452f9d8b25 , < a71143590ce9764dbcb47617647592ff8b4d48bc (git)
Affected: 0110a4c43451533de1ea1bbdc57b5d452f9d8b25 , < 65770111a2d47c2b15e20b2ba92bb12198f289d4 (git)
Affected: 0110a4c43451533de1ea1bbdc57b5d452f9d8b25 , < 015dc4a1e0c2cba551d4620eba13d26d5081dc34 (git)
Affected: 0110a4c43451533de1ea1bbdc57b5d452f9d8b25 , < ba9fa2ff5981589bb49094d3358c339b37c47f53 (git)
Affected: 0110a4c43451533de1ea1bbdc57b5d452f9d8b25 , < 3b15d02be05e74321adb1e0ae0cb4ccfba7c6cb1 (git)
Affected: 0110a4c43451533de1ea1bbdc57b5d452f9d8b25 , < 9faa6b69ad73f03c7bde53e07d75a28822dc9a1a (git)
Affected: 0110a4c43451533de1ea1bbdc57b5d452f9d8b25 , < 486f8298b6188ff11ef1f4be7f1d5d2e4d1b1fae (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/extent-tree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c372ca227e16bace86f1df1fa4ae6849e2fcfa28",
              "status": "affected",
              "version": "0110a4c43451533de1ea1bbdc57b5d452f9d8b25",
              "versionType": "git"
            },
            {
              "lessThan": "a71143590ce9764dbcb47617647592ff8b4d48bc",
              "status": "affected",
              "version": "0110a4c43451533de1ea1bbdc57b5d452f9d8b25",
              "versionType": "git"
            },
            {
              "lessThan": "65770111a2d47c2b15e20b2ba92bb12198f289d4",
              "status": "affected",
              "version": "0110a4c43451533de1ea1bbdc57b5d452f9d8b25",
              "versionType": "git"
            },
            {
              "lessThan": "015dc4a1e0c2cba551d4620eba13d26d5081dc34",
              "status": "affected",
              "version": "0110a4c43451533de1ea1bbdc57b5d452f9d8b25",
              "versionType": "git"
            },
            {
              "lessThan": "ba9fa2ff5981589bb49094d3358c339b37c47f53",
              "status": "affected",
              "version": "0110a4c43451533de1ea1bbdc57b5d452f9d8b25",
              "versionType": "git"
            },
            {
              "lessThan": "3b15d02be05e74321adb1e0ae0cb4ccfba7c6cb1",
              "status": "affected",
              "version": "0110a4c43451533de1ea1bbdc57b5d452f9d8b25",
              "versionType": "git"
            },
            {
              "lessThan": "9faa6b69ad73f03c7bde53e07d75a28822dc9a1a",
              "status": "affected",
              "version": "0110a4c43451533de1ea1bbdc57b5d452f9d8b25",
              "versionType": "git"
            },
            {
              "lessThan": "486f8298b6188ff11ef1f4be7f1d5d2e4d1b1fae",
              "status": "affected",
              "version": "0110a4c43451533de1ea1bbdc57b5d452f9d8b25",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/extent-tree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()\n\nIn the beginning of the loop, we try to obtain a locked delayed ref head,\nif \u0027locked_ref\u0027 is currently NULL, by calling btrfs_select_ref_head(),\nwhich can return an error pointer. If the error pointer is -EAGAIN we do\na continue and go back to the beginning of the loop, which will not try\nagain to call btrfs_select_ref_head() since \u0027locked_ref\u0027 is no longer\nNULL but it\u0027s ERR_PTR(-EAGAIN), and then we do:\n\n   spin_lock(\u0026locked_ref-\u003elock);\n\nagainst a ERR_PTR(-EAGAIN) value, generating an invalid pointer\ndereference.\n\nFix this by ensuring that \u0027locked_ref\u0027 is set to NULL when\nbtrfs_select_ref_head() returns ERR_PTR(-EAGAIN) and incrementing \u0027count\u0027\nas well, to prevent infinite looping. We do this by doing a goto to the\nbottom of the loop that already sets \u0027locked_ref\u0027 to NULL and does a\ncond_resched(), with an increment to \u0027count\u0027 right before the goto.\nThese measures were in place before the refactoring in commit 0110a4c43451\n(\"btrfs: refactor __btrfs_run_delayed_refs loop\") but were unintentionally\nlost afterwards."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On storage servers exporting btrfs via nfsd or ksmbd, remote client write/fsync/unlink I/O reaches btrfs_run_delayed_refs() and __btrfs_run_delayed_refs() in the server kernel without any local syscall; this is the highest-impact but reasonable deployment for btrfs metadata processing.\nAC:L - -EAGAIN is returned when a concurrent task deletes the delayed-ref head during btrfs_delayed_ref_lock(); an attacker controls both sides by driving parallel writes/unlinks/fsync or multiple NFS/SMB clients, reliably hitting the documented race without uncontrollable layout or victim state.\nPR:N - Exploitation needs only network write access to an NFS or SMB export of the btrfs filesystem; no local account, Linux capability, or init-namespace privilege is required when the export permits client writes (including anonymous/guest exports common on NAS appliances).\nUI:N - The fault is triggered entirely by the attacker\u0027s own concurrent filesystem I/O against an already-exported btrfs volume; no separate victim must mount a filesystem, open a file, or perform any interactive action beyond the attacker\u0027s own operations.\nS:U - The invalid pointer dereference and resulting kernel oops occur within the host kernel\u0027s btrfs delayed-ref processing; no VM escape, IOMMU bypass, or cross-sandbox boundary is crossed.\nC:N - The bug dereferences ERR_PTR(-EAGAIN), a small negative sentinel address, not freed or attacker-controlled memory; spin_lock faults immediately without returning kernel data, so there is no information-disclosure or read primitive.\nI:N - This is a logic error causing an invalid pointer dereference, not a use-after-free, out-of-bounds write, or type confusion; no kernel memory is modified before the faulting access aborts execution.\nA:H - Dereferencing ERR_PTR(-EAGAIN) in spin_lock(\u0026locked_ref-\u003elock) causes a kernel oops/panic during delayed-ref processing, which can hang or crash the host and deny all service on the affected btrfs filesystem; the condition is repeatable with concurrent I/O."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:52.396Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c372ca227e16bace86f1df1fa4ae6849e2fcfa28"
        },
        {
          "url": "https://git.kernel.org/stable/c/a71143590ce9764dbcb47617647592ff8b4d48bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/65770111a2d47c2b15e20b2ba92bb12198f289d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/015dc4a1e0c2cba551d4620eba13d26d5081dc34"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba9fa2ff5981589bb49094d3358c339b37c47f53"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b15d02be05e74321adb1e0ae0cb4ccfba7c6cb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/9faa6b69ad73f03c7bde53e07d75a28822dc9a1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/486f8298b6188ff11ef1f4be7f1d5d2e4d1b1fae"
        }
      ],
      "title": "btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74321",
    "datePublished": "2026-08-15T05:58:17.485Z",
    "dateReserved": "2026-08-15T05:44:03.884Z",
    "dateUpdated": "2026-08-17T05:45:52.396Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74321",
      "date": "2026-09-21",
      "epss": "0.00501",
      "percentile": "0.41779"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/btrfs/extent-tree.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c372ca227e16bace86f1df1fa4ae6849e2fcfa28",
                    "status": "affected",
                    "version": "0110a4c43451533de1ea1bbdc57b5d452f9d8b25",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a71143590ce9764dbcb47617647592ff8b4d48bc",
                    "status": "affected",
                    "version": "0110a4c43451533de1ea1bbdc57b5d452f9d8b25",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "65770111a2d47c2b15e20b2ba92bb12198f289d4",
                    "status": "affected",
                    "version": "0110a4c43451533de1ea1bbdc57b5d452f9d8b25",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "015dc4a1e0c2cba551d4620eba13d26d5081dc34",
                    "status": "affected",
                    "version": "0110a4c43451533de1ea1bbdc57b5d452f9d8b25",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ba9fa2ff5981589bb49094d3358c339b37c47f53",
                    "status": "affected",
                    "version": "0110a4c43451533de1ea1bbdc57b5d452f9d8b25",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3b15d02be05e74321adb1e0ae0cb4ccfba7c6cb1",
                    "status": "affected",
                    "version": "0110a4c43451533de1ea1bbdc57b5d452f9d8b25",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9faa6b69ad73f03c7bde53e07d75a28822dc9a1a",
                    "status": "affected",
                    "version": "0110a4c43451533de1ea1bbdc57b5d452f9d8b25",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "486f8298b6188ff11ef1f4be7f1d5d2e4d1b1fae",
                    "status": "affected",
                    "version": "0110a4c43451533de1ea1bbdc57b5d452f9d8b25",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/btrfs/extent-tree.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.20"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()\n\nIn the beginning of the loop, we try to obtain a locked delayed ref head,\nif \u0027locked_ref\u0027 is currently NULL, by calling btrfs_select_ref_head(),\nwhich can return an error pointer. If the error pointer is -EAGAIN we do\na continue and go back to the beginning of the loop, which will not try\nagain to call btrfs_select_ref_head() since \u0027locked_ref\u0027 is no longer\nNULL but it\u0027s ERR_PTR(-EAGAIN), and then we do:\n\n   spin_lock(\u0026locked_ref-\u003elock);\n\nagainst a ERR_PTR(-EAGAIN) value, generating an invalid pointer\ndereference.\n\nFix this by ensuring that \u0027locked_ref\u0027 is set to NULL when\nbtrfs_select_ref_head() returns ERR_PTR(-EAGAIN) and incrementing \u0027count\u0027\nas well, to prevent infinite looping. We do this by doing a goto to the\nbottom of the loop that already sets \u0027locked_ref\u0027 to NULL and does a\ncond_resched(), with an increment to \u0027count\u0027 right before the goto.\nThese measures were in place before the refactoring in commit 0110a4c43451\n(\"btrfs: refactor __btrfs_run_delayed_refs loop\") but were unintentionally\nlost afterwards."
          }
        ],
        "id": "CVE-2026-74321",
        "lastModified": "2026-08-17T06:19:26.520",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:32.600",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/015dc4a1e0c2cba551d4620eba13d26d5081dc34"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3b15d02be05e74321adb1e0ae0cb4ccfba7c6cb1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/486f8298b6188ff11ef1f4be7f1d5d2e4d1b1fae"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/65770111a2d47c2b15e20b2ba92bb12198f289d4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9faa6b69ad73f03c7bde53e07d75a28822dc9a1a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a71143590ce9764dbcb47617647592ff8b4d48bc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ba9fa2ff5981589bb49094d3358c339b37c47f53"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c372ca227e16bace86f1df1fa4ae6849e2fcfa28"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T10:50:35+00:00",
      "cve": "CVE-2026-74321",
      "id": "CVE-2026-74321",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74321.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:27:10Z",
      "cve": "CVE-2026-74321",
      "id": "CVE-2026-74321",
      "initial_release_date": "2026-08-28T00:58:53Z",
      "product_status:known_affected": "626",
      "product_status:known_not_affected": "93",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74321",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74321.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.