CVE-2026-74490

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-74490

Key Details

CVE	CVE-2026-74490
CVSS Score / Version	8.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

tipc: avoid use-after-free in poll trace queue dumps

TIPC socket tracepoints dump queue state through tipc_sk_dump(). Most

queue-dump callsites already serialize that walk under the socket lock or

sk->sk_lock.slock, but tipc_poll() calls trace_tipc_sk_poll(...,

TIPC_DUMP_ALL, ...) without holding either lock.

That lets the poll trace path reach tipc_list_dump() and backlog head/tail

dumping while another context dequeues and frees an skb, leaving the trace

helper dereferencing a stale queue entry.

Stop the unlocked poll trace site from requesting queue dumps. Other queue

dump trace callsites keep their existing output under the locking they

already provide, while poll still emits the event itself without walking

live queue members from an unlocked context. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-74490
CVE	https://www.cve.org/CVERecord?id=CVE-2026-74490

Source

Reference

NVD

CVE