GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-46274 (GCVE-0-2026-46274)

Vulnerability from cvelistv5 – Published: 2026-06-08 14:30 – Updated: 2026-08-05 12:30
VLAI
Title
io-wq: check that the predecessor is hashed in io_wq_remove_pending()
Summary
In the Linux kernel, the following vulnerability has been resolved: io-wq: check that the predecessor is hashed in io_wq_remove_pending() io_wq_remove_pending() needs to fix up wq->hash_tail[] if the cancelled work was the tail of its hash bucket. When doing this, it checks whether the preceding entry in acct->work_list has the same hash value, but never checks that the predecessor is hashed at all. io_get_work_hash() is simply atomic_read(&work->flags) >> IO_WQ_HASH_SHIFT, and the hash bits are never set for non-hashed work, so it returns 0. Thus, when a hashed bucket-0 work is cancelled while a non-hashed work is its list predecessor, the check spuriously passes and a pointer to the non-hashed io_kiocb is stored in wq->hash_tail[0]. Because non-hashed work is dequeued via the fast path in io_get_next_work(), which never touches hash_tail[], the stale pointer is never cleared. Therefore, after the non-hashed io_kiocb completes and is freed back to req_cachep, wq->hash_tail[0] is a dangling pointer. The io_wq is per-task (tctx->io_wq) and survives ring open/close, so the dangling pointer persists for the lifetime of the task; the next hashed bucket-0 enqueue dereferences it in io_wq_insert_work() and wq_list_add_after() writes through freed memory. Add the missing io_wq_is_hashed() check so a non-hashed predecessor never inherits a hash_tail[] slot.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 204361a77f4018627addd4a06877448f088ddfc0 , < d6bda9df0c0a3080804181464d5c0f4d78a4e769 (git)
Affected: 204361a77f4018627addd4a06877448f088ddfc0 , < 5a20ebf0c81b61f5ea3b1b529c100cad69b9f603 (git)
Affected: 204361a77f4018627addd4a06877448f088ddfc0 , < 252c5051dba9c709b6a72f2866f93e5e618b3f06 (git)
Affected: 204361a77f4018627addd4a06877448f088ddfc0 , < d376c131af7c7739a87ff037ed2fdb67c2542c8a (git)
Affected: 204361a77f4018627addd4a06877448f088ddfc0 , < d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc (git)
Affected: 13f35a2c0fd5c6a4fcd8903542b053bcc914fcf5 (git)
Affected: 5.8.6 , < 5.9 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.9
Unaffected: 0 , < 5.9 (semver)
Unaffected: 6.6.141 , ≤ 6.6.* (semver)
Unaffected: 6.12.91 , ≤ 6.12.* (semver)
Unaffected: 6.18.33 , ≤ 6.18.* (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/io-wq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d6bda9df0c0a3080804181464d5c0f4d78a4e769",
              "status": "affected",
              "version": "204361a77f4018627addd4a06877448f088ddfc0",
              "versionType": "git"
            },
            {
              "lessThan": "5a20ebf0c81b61f5ea3b1b529c100cad69b9f603",
              "status": "affected",
              "version": "204361a77f4018627addd4a06877448f088ddfc0",
              "versionType": "git"
            },
            {
              "lessThan": "252c5051dba9c709b6a72f2866f93e5e618b3f06",
              "status": "affected",
              "version": "204361a77f4018627addd4a06877448f088ddfc0",
              "versionType": "git"
            },
            {
              "lessThan": "d376c131af7c7739a87ff037ed2fdb67c2542c8a",
              "status": "affected",
              "version": "204361a77f4018627addd4a06877448f088ddfc0",
              "versionType": "git"
            },
            {
              "lessThan": "d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc",
              "status": "affected",
              "version": "204361a77f4018627addd4a06877448f088ddfc0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "13f35a2c0fd5c6a4fcd8903542b053bcc914fcf5",
              "versionType": "git"
            },
            {
              "lessThan": "5.9",
              "status": "affected",
              "version": "5.8.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "io_uring/io-wq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.8.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio-wq: check that the predecessor is hashed in io_wq_remove_pending()\n\nio_wq_remove_pending() needs to fix up wq-\u003ehash_tail[] if the cancelled\nwork was the tail of its hash bucket. When doing this, it checks whether\nthe preceding entry in acct-\u003ework_list has the same hash value, but\nnever checks that the predecessor is hashed at all. io_get_work_hash()\nis simply atomic_read(\u0026work-\u003eflags) \u003e\u003e IO_WQ_HASH_SHIFT, and the hash\nbits are never set for non-hashed work, so it returns 0. Thus, when a\nhashed bucket-0 work is cancelled while a non-hashed work is its list\npredecessor, the check spuriously passes and a pointer to the non-hashed\nio_kiocb is stored in wq-\u003ehash_tail[0].\n\nBecause non-hashed work is dequeued via the fast path in\nio_get_next_work(), which never touches hash_tail[], the stale pointer\nis never cleared. Therefore, after the non-hashed io_kiocb completes and\nis freed back to req_cachep, wq-\u003ehash_tail[0] is a dangling pointer. The\nio_wq is per-task (tctx-\u003eio_wq) and survives ring open/close, so the\ndangling pointer persists for the lifetime of the task; the next hashed\nbucket-0 enqueue dereferences it in io_wq_insert_work() and\nwq_list_add_after() writes through freed memory.\n\nAdd the missing io_wq_is_hashed() check so a non-hashed predecessor\nnever inherits a hash_tail[] slot."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through io_uring syscalls (io_uring_setup/io_uring_enter) that enqueue and cancel async io-wq work; there is no network, adjacent-radio, or physical-device entry path to io_wq_remove_pending().\nAC:L - An attacker fully controls the trigger sequence\u2014queue a non-hashed async request, queue a hashed bucket-0 request behind it, cancel the hashed pending work, let the non-hashed work complete, then enqueue another hashed bucket-0 request\u2014with no dependence on uncontrollable timing or rare kernel configuration.\nPR:L - Any unprivileged local user who can invoke io_uring (default when kernel.io_uring_disabled=0) can drive the cancel/enqueue sequence; no real-root or special capability beyond normal local process access is required.\nUI:N - Exploitation requires only the attacker\u0027s own io_uring submissions and cancellations; no victim user action such as opening files or mounting filesystems is needed beyond what the attacker initiates.\nS:U - The flaw corrupts kernel heap memory within the same kernel security domain to escalate from local user to kernel privileges; it does not inherently cross a VM/host or IOMMU boundary on its own.\nC:H - The stale hash_tail pointer is a use-after-free of a freed io_kiocb slab object; subsequent dereferences in io_wq_insert_work() read freed memory and UAF heap corruption is routinely weaponizable for arbitrary kernel memory disclosure.\nI:H - io_wq_insert_work() calls wq_list_add_after(), which writes attacker-influenced list pointers through the freed io_kiocb\u0027s list.next field, providing a controlled heap write primitive suitable for further memory corruption or code execution.\nA:H - Dereferencing and writing through the dangling hash_tail pointer can cause kernel oops/panic from invalid slab access, and successful heap corruption can crash or hang the system even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:57.842Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d6bda9df0c0a3080804181464d5c0f4d78a4e769"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a20ebf0c81b61f5ea3b1b529c100cad69b9f603"
        },
        {
          "url": "https://git.kernel.org/stable/c/252c5051dba9c709b6a72f2866f93e5e618b3f06"
        },
        {
          "url": "https://git.kernel.org/stable/c/d376c131af7c7739a87ff037ed2fdb67c2542c8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc"
        }
      ],
      "title": "io-wq: check that the predecessor is hashed in io_wq_remove_pending()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46274",
    "datePublished": "2026-06-08T14:30:53.323Z",
    "dateReserved": "2026-05-13T15:03:33.109Z",
    "dateUpdated": "2026-08-05T12:30:57.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46274",
      "date": "2026-09-16",
      "epss": "0.00138",
      "percentile": "0.03552"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-18T01:50:04.000Z",
      "cve": "CVE-2026-46274",
      "id": "msrc_CVE-2026-46274",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "io-wq: check that the predecessor is hashed in io_wq_remove_pending()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46274.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46274\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-08T16:16:40.707\",\"lastModified\":\"2026-07-23T07:10:00.113\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio-wq: check that the predecessor is hashed in io_wq_remove_pending()\\n\\nio_wq_remove_pending() needs to fix up wq-\u003ehash_tail[] if the cancelled\\nwork was the tail of its hash bucket. When doing this, it checks whether\\nthe preceding entry in acct-\u003ework_list has the same hash value, but\\nnever checks that the predecessor is hashed at all. io_get_work_hash()\\nis simply atomic_read(\u0026work-\u003eflags) \u003e\u003e IO_WQ_HASH_SHIFT, and the hash\\nbits are never set for non-hashed work, so it returns 0. Thus, when a\\nhashed bucket-0 work is cancelled while a non-hashed work is its list\\npredecessor, the check spuriously passes and a pointer to the non-hashed\\nio_kiocb is stored in wq-\u003ehash_tail[0].\\n\\nBecause non-hashed work is dequeued via the fast path in\\nio_get_next_work(), which never touches hash_tail[], the stale pointer\\nis never cleared. Therefore, after the non-hashed io_kiocb completes and\\nis freed back to req_cachep, wq-\u003ehash_tail[0] is a dangling pointer. The\\nio_wq is per-task (tctx-\u003eio_wq) and survives ring open/close, so the\\ndangling pointer persists for the lifetime of the task; the next hashed\\nbucket-0 enqueue dereferences it in io_wq_insert_work() and\\nwq_list_add_after() writes through freed memory.\\n\\nAdd the missing io_wq_is_hashed() check so a non-hashed predecessor\\nnever inherits a hash_tail[] slot.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nio-wq: verificar que el predecesor est\u00e9 hasheado en io_wq_remove_pending()\\n\\nio_wq_remove_pending() necesita corregir wq-\u003ehash_tail[] si el trabajo cancelado era la cola de su cubo hash. Al hacer esto, verifica si la entrada precedente en acct-\u003ework_list tiene el mismo valor hash, pero nunca verifica que el predecesor est\u00e9 hasheado en absoluto. io_get_work_hash() es simplemente atomic_read(\u0026work-\u003eflags) \u003e\u003e IO_WQ_HASH_SHIFT, y los bits hash nunca se establecen para trabajos no hasheados, por lo que devuelve 0. As\u00ed, cuando un trabajo hasheado del cubo 0 es cancelado mientras que un trabajo no hasheado es su predecesor en la lista, la verificaci\u00f3n pasa de forma espuria y un puntero al io_kiocb no hasheado se almacena en wq-\u003ehash_tail[0].\\n\\nDebido a que el trabajo no hasheado se desencola a trav\u00e9s de la ruta r\u00e1pida en io_get_next_work(), que nunca toca hash_tail[], el puntero obsoleto nunca se borra. Por lo tanto, despu\u00e9s de que el io_kiocb no hasheado se completa y se libera de nuevo a req_cachep, wq-\u003ehash_tail[0] es un puntero colgante. El io_wq es por tarea (tctx-\u003eio_wq) y sobrevive a la apertura/cierre del anillo, por lo que el puntero colgante persiste durante la vida \u00fatil de la tarea; la siguiente encolaci\u00f3n hasheada del cubo 0 lo desreferencia en io_wq_insert_work() y wq_list_add_after() escribe a trav\u00e9s de memoria liberada.\\n\\nA\u00f1adir la verificaci\u00f3n io_wq_is_hashed() faltante para que un predecesor no hasheado nunca herede una ranura hash_tail[].\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"io_uring/io-wq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"204361a77f4018627addd4a06877448f088ddfc0\",\"lessThan\":\"d6bda9df0c0a3080804181464d5c0f4d78a4e769\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"204361a77f4018627addd4a06877448f088ddfc0\",\"lessThan\":\"5a20ebf0c81b61f5ea3b1b529c100cad69b9f603\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"204361a77f4018627addd4a06877448f088ddfc0\",\"lessThan\":\"252c5051dba9c709b6a72f2866f93e5e618b3f06\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"204361a77f4018627addd4a06877448f088ddfc0\",\"lessThan\":\"d376c131af7c7739a87ff037ed2fdb67c2542c8a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"204361a77f4018627addd4a06877448f088ddfc0\",\"lessThan\":\"d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13f35a2c0fd5c6a4fcd8903542b053bcc914fcf5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.8.6\",\"lessThan\":\"5.9\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"io_uring/io-wq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.141\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.91\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.33\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.10\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.8.6\",\"versionEndExcluding\":\"5.9\",\"matchCriteriaId\":\"D1A2FB6C-A45E-4E1B-8FE3-D0CDD7BE36C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.9.1\",\"versionEndExcluding\":\"6.6.141\",\"matchCriteriaId\":\"971F5EF2-3F57-4AF7-8366-2D4437ABE0FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.91\",\"matchCriteriaId\":\"C918746B-DE6F-448F-A93E-A04C5481688D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.33\",\"matchCriteriaId\":\"96D99E49-380D-43AB-BDBA-25C3AD018A9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.10\",\"matchCriteriaId\":\"A13475D2-59BF-4716-94B5-7C1D239A2CF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.9:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"F79A2EB6-623E-4749-AEE0-DCB58C4C42F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"A52A4ABE-5C24-4CD4-A348-E303B7F23C71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"12019CF2-FD8E-4D59-BA4C-7093DF0BB091\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.9:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"9B1AB90E-C0C6-4027-B27D-BA214BE33561\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.9:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"103FE5BA-7315-4263-9C95-EABEAD7E174F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.9:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"47E31D6A-31EC-4F63-9CAE-B7A52B58E149\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.9:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"3497462B-A3DA-47CC-A5DD-C1C2D2E6DFDE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D38F0BF-A728-4133-A358-D44A2F7EE6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC732D08-5F7B-46D9-B154-E60C7F4F0A97\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/252c5051dba9c709b6a72f2866f93e5e618b3f06\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a20ebf0c81b61f5ea3b1b529c100cad69b9f603\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d376c131af7c7739a87ff037ed2fdb67c2542c8a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d6bda9df0c0a3080804181464d5c0f4d78a4e769\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:46:09+00:00",
      "cve": "CVE-2026-46274",
      "id": "CVE-2026-46274",
      "initial_release_date": "2026-06-08T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: io-wq: check that the predecessor is hashed in io_wq_remove_pending()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46274.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-09T00:19:21Z",
      "cve": "CVE-2026-46274",
      "id": "CVE-2026-46274",
      "initial_release_date": "2026-06-09T02:21:17Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "198",
      "product_status:recommended": "580",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46274",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46274.json",
      "version": "20"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.