CVE-2026-74470 (GCVE-0-2026-74470)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-23 12:47
VLAI
Title
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write resp_report_zones() sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloc_len up with ALIGN() before deriving the descriptor count: rep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) - RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD); arr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1); For alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to 0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()'s size_t is 32-bit and truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which passes the !arr check, and desc = arr + 64 is then dereferenced in the loop -> out-of-bounds write / panic. Clamp rep_max_zones to devip->nr_zones. The loop already stops at sdebug_capacity (after nr_zones zones), so a report can never hold more than nr_zones descriptors; the clamp does not change the report, it only bounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device property that can never reach 0x100000000.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ebacb44cb2042b90951140eda806bedad23ef554 , < 7b615fc139e35c81077046df44725c532f7e2404 (git)
Affected: 7db0e0c8190a086ef92ce5bb960836cde49540aa , < 5d3e1d006bbb543259f9e31824caadbfff6a5465 (git)
Affected: 7db0e0c8190a086ef92ce5bb960836cde49540aa , < 49e5b25a0b74dbac595f122e5608fdce2918cc4e (git)
Affected: 7db0e0c8190a086ef92ce5bb960836cde49540aa , < 495058429ca55ab7fcc21977b63b92907ad68066 (git)
Affected: 7db0e0c8190a086ef92ce5bb960836cde49540aa , < 2047ed09bf13453b7d6f9431b112ec07984dd69b (git)
Affected: 7db0e0c8190a086ef92ce5bb960836cde49540aa , < d6e6da6bc3b53231fac77ffab428da8173ee729c (git)
Affected: 7db0e0c8190a086ef92ce5bb960836cde49540aa , < 93dde0bf2f39a0f9f57fd610aa3201ce5b753433 (git)
Affected: c4d2d7c935a4ad20e8e726ca10499cefe4537103 (git)
Affected: 5.15.8 , < 5.15.217 (semver)
Affected: 5.10.85 , < 5.11 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/scsi_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7b615fc139e35c81077046df44725c532f7e2404",
              "status": "affected",
              "version": "ebacb44cb2042b90951140eda806bedad23ef554",
              "versionType": "git"
            },
            {
              "lessThan": "5d3e1d006bbb543259f9e31824caadbfff6a5465",
              "status": "affected",
              "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
              "versionType": "git"
            },
            {
              "lessThan": "49e5b25a0b74dbac595f122e5608fdce2918cc4e",
              "status": "affected",
              "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
              "versionType": "git"
            },
            {
              "lessThan": "495058429ca55ab7fcc21977b63b92907ad68066",
              "status": "affected",
              "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
              "versionType": "git"
            },
            {
              "lessThan": "2047ed09bf13453b7d6f9431b112ec07984dd69b",
              "status": "affected",
              "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
              "versionType": "git"
            },
            {
              "lessThan": "d6e6da6bc3b53231fac77ffab428da8173ee729c",
              "status": "affected",
              "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
              "versionType": "git"
            },
            {
              "lessThan": "93dde0bf2f39a0f9f57fd610aa3201ce5b753433",
              "status": "affected",
              "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c4d2d7c935a4ad20e8e726ca10499cefe4537103",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.217",
              "status": "affected",
              "version": "5.15.8",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.85",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/scsi_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.15.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.85",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write\n\nresp_report_zones() sizes the reply buffer from the CDB allocation\nlength. The v3 fix rounds alloc_len up with ALIGN() before deriving the\ndescriptor count:\n\n\trep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) -\n\t\t\t RZONES_DESC_HD) \u003e\u003e ilog2(RZONES_DESC_HD);\n\tarr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1);\n\nFor alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to\n0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()\u0027s size_t is 32-bit\nand truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which\npasses the !arr check, and desc = arr + 64 is then dereferenced in the\nloop -\u003e out-of-bounds write / panic.\n\nClamp rep_max_zones to devip-\u003enr_zones. The loop already stops at\nsdebug_capacity (after nr_zones zones), so a report can never hold more\nthan nr_zones descriptors; the clamp does not change the report, it only\nbounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device\nproperty that can never reach 0x100000000."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached by sending a crafted ZONE IN REPORT ZONES SCSI CDB through local SG_IO/BSG ioctl on a scsi_debug zoned LUN; scsi_debug is a pseudo host simulator with no native network protocol handler.\nAC:L - Once scsi_debug is loaded in host-managed zoned mode, a single REPORT ZONES command with ALLOCATION LENGTH 1-63 reliably underflows rep_max_zones and forces heap writes past a tiny kzalloc buffer; no races or victim-dependent timing are required.\nPR:L - ZBC_IN is whitelisted in scsi_cmd_allowed() without CAP_SYS_RAWIO, so any local user who can open the scsi_debug /dev/sg or BSG node (e.g., disk group) can issue the malicious CDB; module load and zoned setup are environmental, not exploit-time privileges.\nUI:N - Exploitation requires only the attacker issuing SG_IO/BSG with a malicious REPORT ZONES CDB; no separate victim interaction such as mounting media or clicking a prompt is needed.\nS:U - The out-of-bounds write corrupts kernel heap memory in the same host kernel security authority; it is not a VM escape, IOMMU bypass, or other cross-boundary compromise.\nC:H - The kmalloc heap out-of-bounds write can corrupt adjacent slab objects and be groomed into arbitrary kernel memory disclosure primitives; per kernel guidance, exploitable out-of-bounds writes warrant High confidentiality impact.\nI:H - Attacker-controlled REPORT ZONES allocation length drives rep_max_zones and causes repeated 64-byte descriptor writes far beyond the allocated buffer, providing a kernel heap out-of-bounds write suitable for control-data corruption and privilege escalation.\nA:H - Writing zone descriptors from arr+64 when the buffer is smaller than 64 bytes immediately corrupts out-of-bounds kernel memory and commonly triggers KASAN faults, kernel oops, or panic, satisfying High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:20.125Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7b615fc139e35c81077046df44725c532f7e2404"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d3e1d006bbb543259f9e31824caadbfff6a5465"
        },
        {
          "url": "https://git.kernel.org/stable/c/49e5b25a0b74dbac595f122e5608fdce2918cc4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/495058429ca55ab7fcc21977b63b92907ad68066"
        },
        {
          "url": "https://git.kernel.org/stable/c/2047ed09bf13453b7d6f9431b112ec07984dd69b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6e6da6bc3b53231fac77ffab428da8173ee729c"
        },
        {
          "url": "https://git.kernel.org/stable/c/93dde0bf2f39a0f9f57fd610aa3201ce5b753433"
        }
      ],
      "title": "scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74470",
    "datePublished": "2026-08-15T12:27:07.504Z",
    "dateReserved": "2026-08-15T05:44:03.902Z",
    "dateUpdated": "2026-08-23T12:47:20.125Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74470",
      "date": "2026-09-20",
      "epss": "0.00129",
      "percentile": "0.02935"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:53:38.000Z",
      "cve": "CVE-2026-74470",
      "id": "msrc_CVE-2026-74470",
      "initial_release_date": "2026-08-23T14:50:28.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74470.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/scsi_debug.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7b615fc139e35c81077046df44725c532f7e2404",
                    "status": "affected",
                    "version": "ebacb44cb2042b90951140eda806bedad23ef554",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5d3e1d006bbb543259f9e31824caadbfff6a5465",
                    "status": "affected",
                    "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "49e5b25a0b74dbac595f122e5608fdce2918cc4e",
                    "status": "affected",
                    "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "495058429ca55ab7fcc21977b63b92907ad68066",
                    "status": "affected",
                    "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2047ed09bf13453b7d6f9431b112ec07984dd69b",
                    "status": "affected",
                    "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d6e6da6bc3b53231fac77ffab428da8173ee729c",
                    "status": "affected",
                    "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "93dde0bf2f39a0f9f57fd610aa3201ce5b753433",
                    "status": "affected",
                    "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "c4d2d7c935a4ad20e8e726ca10499cefe4537103",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.15.217",
                    "status": "affected",
                    "version": "5.15.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.11",
                    "status": "affected",
                    "version": "5.10.85",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/scsi_debug.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.16"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.217",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write\n\nresp_report_zones() sizes the reply buffer from the CDB allocation\nlength. The v3 fix rounds alloc_len up with ALIGN() before deriving the\ndescriptor count:\n\n\trep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) -\n\t\t\t RZONES_DESC_HD) \u003e\u003e ilog2(RZONES_DESC_HD);\n\tarr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1);\n\nFor alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to\n0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()\u0027s size_t is 32-bit\nand truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which\npasses the !arr check, and desc = arr + 64 is then dereferenced in the\nloop -\u003e out-of-bounds write / panic.\n\nClamp rep_max_zones to devip-\u003enr_zones. The loop already stops at\nsdebug_capacity (after nr_zones zones), so a report can never hold more\nthan nr_zones descriptors; the clamp does not change the report, it only\nbounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device\nproperty that can never reach 0x100000000."
          }
        ],
        "id": "CVE-2026-74470",
        "lastModified": "2026-08-23T13:16:43.967",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:17:51.727",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2047ed09bf13453b7d6f9431b112ec07984dd69b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/495058429ca55ab7fcc21977b63b92907ad68066"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/49e5b25a0b74dbac595f122e5608fdce2918cc4e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5d3e1d006bbb543259f9e31824caadbfff6a5465"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7b615fc139e35c81077046df44725c532f7e2404"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/93dde0bf2f39a0f9f57fd610aa3201ce5b753433"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d6e6da6bc3b53231fac77ffab428da8173ee729c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T14:55:35+00:00",
      "cve": "CVE-2026-74470",
      "id": "CVE-2026-74470",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74470.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:20:38Z",
      "cve": "CVE-2026-74470",
      "id": "CVE-2026-74470",
      "initial_release_date": "2026-08-15T23:52:21Z",
      "product_status:known_affected": "219",
      "product_status:known_not_affected": "143",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74470",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74470.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.