What is the CVSS score of CVE-2026-74317?

CVE-2026-74317 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel ixgbe are affected by CVE-2026-74317?

A kernel memory corruption vulnerability (CVE-2026-74317) in the Linux ixgbe driver affects Intel E610 network adapters on systems with 64 or more CPU cores, creating denial-of-service and privilege…. A patch is available.

How to fix or mitigate CVE-2026-74317?

Within 24 hours, inventory all Linux servers with Intel E610 network adapters and 64+ logical CPUs to identify affected infrastructure and document current kernel versions. Within 7 days, obtain the kernel security patch from your Linux vendor for CVE-2026-74317, validate in a non-production environment, and schedule production deployment. Within 30 days, complete kernel updates across all identified affected production systems, coordinating maintenance windows with operations teams to minimize service disruption.

Linux Kernel ixgbe CVE-2026-74317

EUVD-2026-59464 HIGH

2026-08-15 Linux

GHSA-22fj-hf7w-2cq4

Buffer Overflow Linux Red Hat

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

AC:H reflects concrete hardware prerequisites (Intel E610 and ≥64 CPUs); PR:L retained for CAP_NET_ADMIN requirement typical in container environments.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 10:30 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:58 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 05:58 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ixgbe: do not configure xps for XDP queues

netif_set_xps_queue() should not be called for an XDP Tx queue, since such queues are not netdev-exposed. On systems with number of CPUs >=64, on E610 adapter, netdev is configured with maximum number queue pairs being 63 (due to MSI-X assignment), but configuring XDP results in 64 XDP queues.

So, during XDP program load, when netif_set_xps_queue() is called for the last XDP queue, we get a WARNING with a call trace and KASAN report afterwards (if enabled).

[ 2012.699800] WARNING: net/core/dev.c:2854 at __netif_set_xps_queue+0x116a/0x1e40, CPU#36: xdpsock/103668 [...] [ 2012.700029] RIP: 0010:__netif_set_xps_queue+0x116a/0x1e40 [ 2012.700035] Code: b6 34 06 48 89 f8 83 e0 07 83 c0 01 40 38 f0 7c 09 40 84 f6 0f 85 03 0a 00 00 0f b7 44 24 40 66 43 89 44 6a 18 e9 01 fb ff ff <0f> 0b e9 f2 ee ff ff 44 8b 44 24 44 45 85 c0 74 50 4d 85 e4 0f 84 [ 2012.700040] RSP: 0018:ffff8882369aeb28 EFLAGS: 00010246 [ 2012.700046] RAX: 0000000000000000 RBX: 000000000000003f RCX: 0000000000000000 [ 2012.700050] RDX: 1ffff1111da3d891 RSI: ffff888120e34250 RDI: ffff8888ed1ec488 [ 2012.700054] RBP: ffff888913281560 R08: 0000000000000000 R09: ffff8888ed1ec000 [ 2012.700058] R10: ffff8888a2e83180 R11: 0000000000000000 R12: 0000000000007fa8 [ 2012.700061] R13: 000000000000003f R14: ffff888120e34854 R15: ffff8889132817c8 [ 2012.700065] FS: 00007fc8ea9ff740(0000) GS:ffff88884cefe000(0000) knlGS:0000000000000000 [ 2012.700069] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2012.700073] CR2: 00007f81c8000020 CR3: 00000002299f8006 CR4: 00000000007726f0 [ 2012.700077] PKRU: 55555554 [ 2012.700080] Call Trace: [ 2012.700084] <TASK> [ 2012.700087] ? ktime_get+0x61/0x150 [ 2012.700097] ? usleep_range_state+0x133/0x1b0 [ 2012.700108] ? __pfx_usleep_range_state+0x10/0x10 [ 2012.700114] netif_set_xps_queue+0x31/0x50 [ 2012.700119] ixgbe_configure_tx_ring+0x472/0x920 [ixgbe] [...] [ 2012.700486] ixgbe_xdp+0x38f/0x750 [ixgbe]

[...]

[ 2012.701094] BUG: KASAN: slab-out-of-bounds in __netif_set_xps_queue+0x1ac5/0x1e40 [ 2012.701100] Write of size 4 at addr ffff88888d43cff8 by task xdpsock/103668

Skip XPS configuration for XDP Tx queues.

AnalysisAI

Linux kernel ixgbe driver on Intel E610 adapters triggers a KASAN slab-out-of-bounds write when an XDP program is loaded on hosts with 64 or more logical CPUs. The root cause is a queue-count mismatch: MSI-X constraints cap the netdev at 63 queue pairs on E610, but XDP allocates 64 queues on ≥64-CPU systems, causing netif_set_xps_queue() to write 4 bytes beyond the allocated slab at queue index 63. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Obtain CAP_NET_ADMIN on target host

Delivery

Confirm Intel E610 NIC with ixgbe driver active

Exploit

Verify ≥64 logical CPUs on host

Install

Craft minimal XDP BPF program

Attach XDP program via ip link set xdp

Execute

Trigger slab-out-of-bounds write at XDP queue 63

Impact

Leverage heap corruption for kernel privilege escalation

Recon

Obtain CAP_NET_ADMIN on target host

Delivery

Confirm Intel E610 NIC with ixgbe driver active

Exploit

Verify ≥64 logical CPUs on host

Install

Craft minimal XDP BPF program

Attach XDP program via ip link set xdp

Execute

Trigger slab-out-of-bounds write at XDP queue 63

Impact

Leverage heap corruption for kernel privilege escalation

Vulnerability AssessmentAI

Exploitation	All three of the following conditions must be simultaneously present: (1) the target system must be running the Intel E610 series NIC with the ixgbe kernel driver loaded and active; (2) the host must have 64 or more logical CPUs - this is the precise threshold at which XDP queue allocation (one per CPU) exceeds the MSI-X-capped netdev queue count of 63, creating the off-by-one; (3) the attacker must possess CAP_NET_ADMIN capability (or equivalent privileges) sufficient to attach an XDP program to the network interface via ip link or a BPF syscall. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) captures the potential kernel memory corruption impact accurately but overstates ease of exploitation: AC:L does not reflect the hardware prerequisite (Intel E610 adapter) and CPU-count requirement (≥64 logical CPUs) needed to reach the vulnerable code path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local attacker with CAP_NET_ADMIN on a ≥64-CPU server equipped with an Intel E610 NIC runs 'ip link set dev eth0 xdp obj prog.o' to attach a crafted XDP program, triggering ixgbe_configure_tx_ring() to call netif_set_xps_queue() for XDP queue index 63. The resulting 4-byte slab-out-of-bounds write corrupts adjacent kernel heap metadata; with knowledge of heap layout (e.g., via a kernel info-leak pairing), an attacker could overwrite a function pointer or security-critical structure to escalate privileges to root. …
Remediation	Upgrade to Linux kernel 7.1.5 or any later stable release, or 7.2-rc1 or later for development kernels. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Linux servers with Intel E610 network adapters and 64+ logical CPUs to identify affected infrastructure and document current kernel versions. …

Threat intelligence, references, and detailed analysis are available after sign-in.