Linux Kernel CVE-2026-74306

Exploitation requires all of the following: (1) local code execution on the target host with at minimum low-privilege user access (CVSS PR:L confirmed) - remote exploitation without prior local foothold is not possible given AV:L; (2) Intel QuickAssist Technology (QAT) hardware physically present in the host with SR-IOV virtual functions configured; (3) the vfio/qat kernel module loaded and a QAT virtual function exposed through the VFIO migration file interface; (4) the ability to open the QAT VF migration file and issue concurrent write() calls - this is typically accessible only to processes involved in VM live migration management; (5) successfully winning a kernel-level timing race between two concurrent writers within the TOCTOU window in qat_vf_resume_write(). Limiting factors that reduce real-world exploitability beyond the raw CVSS score: the Intel QAT VFIO hardware dependency eliminates the vast majority of Linux deployments; systems without SR-IOV or with the qat_vfio module blacklisted are entirely unaffected; the AC:L CVSS rating understates practical race exploitation difficulty; and PR:L rules out external network attackers without a prior local foothold.

The NVD CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full kernel-compromise potential upon successful exploitation, but AC:L is arguably optimistic for a write-write race condition - reliably winning kernel-level timing races typically requires environmental staging, repeated attempts, or auxiliary primitives, which this analyst rates as AC:H in practice. EPSS at 0.17% and the 6th percentile is strongly consistent with a niche driver vulnerability that has no known public proof-of-concept and is not listed in the CISA KEV catalog, making confirmed active exploitation unsubstantiated. SSVC signals align: exploitation status is none confirmed, the attack is not straightforwardly automatable given hardware dependency and timing requirements, but technical impact if exploited is total (kernel-mode write). The real-world attack surface is further constrained by the requirement for Intel QAT hardware with SR-IOV and VFIO migration enabled - a configuration present in specialized cloud, HPC, or telco deployments rather than general-purpose servers; even a mid-sized cloud infrastructure operator in rybnik running QAT-accelerated VM workloads should treat this as a planned patch-cycle priority rather than an emergency response, unless concurrent VF migration write access by potentially hostile tenants is part of their threat model. Overall, this is a genuine kernel vulnerability warranting patch deployment on affected systems, but low EPSS, no KEV, and narrow hardware prerequisites keep it well below critical triage priority for most organizations.

A local attacker with low-privilege code execution on a hypervisor host running Intel QAT hardware with VFIO virtual function passthrough enabled opens the QAT VF migration file interface and spawns two concurrent threads that both issue write() calls simultaneously. Both threads observe the unadvanced f_pos, pass the boundary check, and then serialize under migf->lock - at which point the second thread writes at an already-advanced offset, placing data beyond the end of the migration-state buffer into adjacent kernel memory. Successful exploitation of this kernel out-of-bounds write could enable privilege escalation to root, information disclosure from adjacent kernel structures, or a kernel panic causing system crash. No public proof-of-concept exploit code has been identified at time of analysis, and practical exploitation additionally requires winning a precise kernel-level timing race.