CVE-2026-74398 (GCVE-0-2026-74398)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:59 – Updated: 2026-08-17 05:46
VLAI
Title
ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD addrconf_dad_failure() transitions ifp->state from DAD to POSTDAD via addrconf_dad_end(), which drops ifp->lock on return. The lock is re-acquired after net_info_ratelimited(). A concurrent ipv6_del_addr() can take the lock in that window, set ifp->state to DEAD and run list_del_rcu(&ifp->if_list). addrconf_dad_failure() then overwrites DEAD with ERRDAD at errdad: and schedules a new dad_work. The work calls ipv6_del_addr() again, hitting the already-poisoned list entry: general protection fault: 0000 [#1] SMP NOPTI CPU: 4 PID: 217 Comm: kworker/4:1 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:ipv6_del_addr+0xe9/0x280 RAX: dead000000000122 Call Trace: addrconf_dad_stop+0x113/0x140 addrconf_dad_work+0x28c/0x430 process_one_work+0x1eb/0x3b0 worker_thread+0x4d/0x400 kthread+0x104/0x140 ret_from_fork+0x35/0x40 Fold the addrconf_dad_end() logic into addrconf_dad_failure() under a single ifp->lock critical section. The STABLE_PRIVACY branch temporarily drops ifp->lock around address regeneration, so at lock_errdad: verify the state is still POSTDAD before transitioning to ERRDAD; bail out otherwise to avoid overwriting a state set by another path while the lock was released.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c15b1ccadb323ea50023e8f1cca2954129a62b51 , < 47b05836705b63dab93d9ac7c69a3a507375ef80 (git)
Affected: c15b1ccadb323ea50023e8f1cca2954129a62b51 , < d21be7d051012c6b572fa4e3334443c250216f7b (git)
Affected: c15b1ccadb323ea50023e8f1cca2954129a62b51 , < 875c284c0f98b042bb97abad460f63a24c977f88 (git)
Affected: c15b1ccadb323ea50023e8f1cca2954129a62b51 , < 8ed0ce9ea58d677d1bac92614ee5f60f8ea57363 (git)
Affected: c15b1ccadb323ea50023e8f1cca2954129a62b51 , < 3bdc86d89fd6c6523753fa6f42fcfaf30ee699cb (git)
Affected: c15b1ccadb323ea50023e8f1cca2954129a62b51 , < b61af0268e3d1308c466bf0be5dced844eafc1ef (git)
Affected: c15b1ccadb323ea50023e8f1cca2954129a62b51 , < e889aa99ad3ed48bb0ddcff6475b17542532d18b (git)
Affected: c15b1ccadb323ea50023e8f1cca2954129a62b51 , < 627ac78f2741e2ebd2225e2e953b6964a8a9182f (git)
Affected: 835b474b8f70fa68d68abffad37378e92f661802 (git)
Affected: 3.10.105 , < 3.11 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 3.14
Unaffected: 0 , < 3.14 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/addrconf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "47b05836705b63dab93d9ac7c69a3a507375ef80",
              "status": "affected",
              "version": "c15b1ccadb323ea50023e8f1cca2954129a62b51",
              "versionType": "git"
            },
            {
              "lessThan": "d21be7d051012c6b572fa4e3334443c250216f7b",
              "status": "affected",
              "version": "c15b1ccadb323ea50023e8f1cca2954129a62b51",
              "versionType": "git"
            },
            {
              "lessThan": "875c284c0f98b042bb97abad460f63a24c977f88",
              "status": "affected",
              "version": "c15b1ccadb323ea50023e8f1cca2954129a62b51",
              "versionType": "git"
            },
            {
              "lessThan": "8ed0ce9ea58d677d1bac92614ee5f60f8ea57363",
              "status": "affected",
              "version": "c15b1ccadb323ea50023e8f1cca2954129a62b51",
              "versionType": "git"
            },
            {
              "lessThan": "3bdc86d89fd6c6523753fa6f42fcfaf30ee699cb",
              "status": "affected",
              "version": "c15b1ccadb323ea50023e8f1cca2954129a62b51",
              "versionType": "git"
            },
            {
              "lessThan": "b61af0268e3d1308c466bf0be5dced844eafc1ef",
              "status": "affected",
              "version": "c15b1ccadb323ea50023e8f1cca2954129a62b51",
              "versionType": "git"
            },
            {
              "lessThan": "e889aa99ad3ed48bb0ddcff6475b17542532d18b",
              "status": "affected",
              "version": "c15b1ccadb323ea50023e8f1cca2954129a62b51",
              "versionType": "git"
            },
            {
              "lessThan": "627ac78f2741e2ebd2225e2e953b6964a8a9182f",
              "status": "affected",
              "version": "c15b1ccadb323ea50023e8f1cca2954129a62b51",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "835b474b8f70fa68d68abffad37378e92f661802",
              "versionType": "git"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.105",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/addrconf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.105",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD\n\naddrconf_dad_failure() transitions ifp-\u003estate from DAD to POSTDAD\nvia addrconf_dad_end(), which drops ifp-\u003elock on return.  The lock\nis re-acquired after net_info_ratelimited().  A concurrent\nipv6_del_addr() can take the lock in that window, set ifp-\u003estate\nto DEAD and run list_del_rcu(\u0026ifp-\u003eif_list).\n\naddrconf_dad_failure() then overwrites DEAD with ERRDAD at errdad:\nand schedules a new dad_work.  The work calls ipv6_del_addr()\nagain, hitting the already-poisoned list entry:\n\n  general protection fault: 0000 [#1] SMP NOPTI\n  CPU: 4 PID: 217 Comm: kworker/4:1\n  Workqueue: ipv6_addrconf addrconf_dad_work\n  RIP: 0010:ipv6_del_addr+0xe9/0x280\n  RAX: dead000000000122\n  Call Trace:\n   addrconf_dad_stop+0x113/0x140\n   addrconf_dad_work+0x28c/0x430\n   process_one_work+0x1eb/0x3b0\n   worker_thread+0x4d/0x400\n   kthread+0x104/0x140\n   ret_from_fork+0x35/0x40\n\nFold the addrconf_dad_end() logic into addrconf_dad_failure() under\na single ifp-\u003elock critical section.  The STABLE_PRIVACY branch\ntemporarily drops ifp-\u003elock around address regeneration, so at\nlock_errdad: verify the state is still POSTDAD before transitioning\nto ERRDAD; bail out otherwise to avoid overwriting a state set by\nanother path while the lock was released."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached from inbound ICMPv6 Neighbor Discovery (NS/NA) packets processed by icmp6_rcv()\u2192ndisc_rcv()\u2192addrconf_dad_failure(), the standard IPv6 network receive path on internet-facing servers, cloud VMs, phones, and IoT devices on shared L2 segments.\nAC:L - An attacker controls both sides of the race by flooding forged NS/NA during DAD while concurrently triggering ipv6_del_addr() via RTM_DELADDR/CAP_NET_ADMIN in a user namespace, CNI/orchestration address teardown, or interface-down processing; retries make the narrow window reliably winnable.\nPR:N - Triggering DAD failure requires only unauthenticated ND packet injection on the victim\u0027s link; the concurrent ipv6_del_addr() leg needs no victim credentials and can come from automatic address lifecycle events (CNI churn, SLAAC/privacy regeneration, netdev down) rather than attacker admin rights.\nUI:N - Exploitation does not require any victim user action such as opening files or mounting filesystems; it targets automatic IPv6 address configuration and DAD processing that occurs during normal network connectivity and boot.\nS:U - The corrupted inet6_ifaddr lifecycle and resulting kernel crash occur within kernel memory management; impact does not cross a VM, container, or IOMMU security boundary into a separate authority.\nC:H - The race leaves a freed/partially torn-down inet6_ifaddr with corrupted state and a poisoned RCU list entry (LIST_POISON2), constituting use-after-free class memory corruption that can expose adjacent kernel heap contents beyond a pure crash.\nI:H - Corrupting inet6_ifaddr state after list_del_rcu() and re-queuing dad_work on a dead object enables heap reuse and control of freed object contents, providing a path to arbitrary kernel memory writes and potential code execution beyond denial of service.\nA:H - The demonstrated failure is a general protection fault in ipv6_del_addr() from addrconf_dad_work on the ipv6_addrconf workqueue, causing a kernel oops/panic and complete loss of system availability on affected hosts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:43.132Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/47b05836705b63dab93d9ac7c69a3a507375ef80"
        },
        {
          "url": "https://git.kernel.org/stable/c/d21be7d051012c6b572fa4e3334443c250216f7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/875c284c0f98b042bb97abad460f63a24c977f88"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ed0ce9ea58d677d1bac92614ee5f60f8ea57363"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bdc86d89fd6c6523753fa6f42fcfaf30ee699cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/b61af0268e3d1308c466bf0be5dced844eafc1ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/e889aa99ad3ed48bb0ddcff6475b17542532d18b"
        },
        {
          "url": "https://git.kernel.org/stable/c/627ac78f2741e2ebd2225e2e953b6964a8a9182f"
        }
      ],
      "title": "ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74398",
    "datePublished": "2026-08-15T05:59:10.113Z",
    "dateReserved": "2026-08-15T05:44:03.891Z",
    "dateUpdated": "2026-08-17T05:46:43.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74398",
      "date": "2026-09-21",
      "epss": "0.00514",
      "percentile": "0.4263"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv6/addrconf.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "47b05836705b63dab93d9ac7c69a3a507375ef80",
                    "status": "affected",
                    "version": "c15b1ccadb323ea50023e8f1cca2954129a62b51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d21be7d051012c6b572fa4e3334443c250216f7b",
                    "status": "affected",
                    "version": "c15b1ccadb323ea50023e8f1cca2954129a62b51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "875c284c0f98b042bb97abad460f63a24c977f88",
                    "status": "affected",
                    "version": "c15b1ccadb323ea50023e8f1cca2954129a62b51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8ed0ce9ea58d677d1bac92614ee5f60f8ea57363",
                    "status": "affected",
                    "version": "c15b1ccadb323ea50023e8f1cca2954129a62b51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3bdc86d89fd6c6523753fa6f42fcfaf30ee699cb",
                    "status": "affected",
                    "version": "c15b1ccadb323ea50023e8f1cca2954129a62b51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b61af0268e3d1308c466bf0be5dced844eafc1ef",
                    "status": "affected",
                    "version": "c15b1ccadb323ea50023e8f1cca2954129a62b51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e889aa99ad3ed48bb0ddcff6475b17542532d18b",
                    "status": "affected",
                    "version": "c15b1ccadb323ea50023e8f1cca2954129a62b51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "627ac78f2741e2ebd2225e2e953b6964a8a9182f",
                    "status": "affected",
                    "version": "c15b1ccadb323ea50023e8f1cca2954129a62b51",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "835b474b8f70fa68d68abffad37378e92f661802",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3.11",
                    "status": "affected",
                    "version": "3.10.105",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv6/addrconf.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.14"
                  },
                  {
                    "lessThan": "3.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD\n\naddrconf_dad_failure() transitions ifp-\u003estate from DAD to POSTDAD\nvia addrconf_dad_end(), which drops ifp-\u003elock on return.  The lock\nis re-acquired after net_info_ratelimited().  A concurrent\nipv6_del_addr() can take the lock in that window, set ifp-\u003estate\nto DEAD and run list_del_rcu(\u0026ifp-\u003eif_list).\n\naddrconf_dad_failure() then overwrites DEAD with ERRDAD at errdad:\nand schedules a new dad_work.  The work calls ipv6_del_addr()\nagain, hitting the already-poisoned list entry:\n\n  general protection fault: 0000 [#1] SMP NOPTI\n  CPU: 4 PID: 217 Comm: kworker/4:1\n  Workqueue: ipv6_addrconf addrconf_dad_work\n  RIP: 0010:ipv6_del_addr+0xe9/0x280\n  RAX: dead000000000122\n  Call Trace:\n   addrconf_dad_stop+0x113/0x140\n   addrconf_dad_work+0x28c/0x430\n   process_one_work+0x1eb/0x3b0\n   worker_thread+0x4d/0x400\n   kthread+0x104/0x140\n   ret_from_fork+0x35/0x40\n\nFold the addrconf_dad_end() logic into addrconf_dad_failure() under\na single ifp-\u003elock critical section.  The STABLE_PRIVACY branch\ntemporarily drops ifp-\u003elock around address regeneration, so at\nlock_errdad: verify the state is still POSTDAD before transitioning\nto ERRDAD; bail out otherwise to avoid overwriting a state set by\nanother path while the lock was released."
          }
        ],
        "id": "CVE-2026-74398",
        "lastModified": "2026-08-17T06:19:34.937",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:41.790",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3bdc86d89fd6c6523753fa6f42fcfaf30ee699cb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/47b05836705b63dab93d9ac7c69a3a507375ef80"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/627ac78f2741e2ebd2225e2e953b6964a8a9182f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/875c284c0f98b042bb97abad460f63a24c977f88"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8ed0ce9ea58d677d1bac92614ee5f60f8ea57363"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b61af0268e3d1308c466bf0be5dced844eafc1ef"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d21be7d051012c6b572fa4e3334443c250216f7b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e889aa99ad3ed48bb0ddcff6475b17542532d18b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T22:19:27+00:00",
      "cve": "CVE-2026-74398",
      "id": "CVE-2026-74398",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74398.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:21:38Z",
      "cve": "CVE-2026-74398",
      "id": "CVE-2026-74398",
      "initial_release_date": "2026-08-29T01:08:25Z",
      "product_status:known_affected": "269",
      "product_status:known_not_affected": "93",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74398",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74398.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.