What is the CVSS score of CVE-2026-74343?

CVE-2026-74343 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74343?

A race condition in Linux kernel 7.1 and earlier allows local users to corrupt shared file system metadata across administrative boundaries; no public exploit has been identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-74343?

Within 24 hours, scan infrastructure for systems running Linux kernel 7.1 or earlier to establish patching scope and prioritize high-risk deployments. Within 7 days, apply available kernel patches to non-production systems and establish patch deployment procedures. Within 30 days, complete kernel updates across production infrastructure and document patch compliance across all systems.

Linux Kernel CVE-2026-74343

EUVD-2026-59490 HIGH

2026-08-15 Linux

GHSA-rxfr-7h9v-g4vx

Information Disclosure Linux Red Hat

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition requires precise concurrent timing across multiple namespace-shared superblocks, warranting AC:H over the vendor-assigned AC:L.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 10:39 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 07:19 EUVD

CVE Published

Aug 15, 2026 - 05:58 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 05:58 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

kernfs: fix xattr race condition with multiple superblocks

Multiple superblocks with different namespaces can share the same kernfs_node when kernfs_test_super() finds a matching root but different namespace. This means multiple inodes from different superblocks can reference the same kernfs_node->iattr->xattrs structure.

The VFS layer only holds per-inode locks during xattr operations, which is insufficient to serialize concurrent xattr modifications on the shared kernfs_node. This can lead to race conditions in simple_xattr_set() where the lookup->replace/remove sequence is not atomic with respect to operations from other superblocks.

Fix this by protecting xattr operations with the existing hashed kernfs_locks->open_file_mutex[] array, which is already used to protect per-node open file data. The hashed mutex array provides scalable per-node serialization (scaled by CPU count, up to 1024 locks on 32+ CPU systems) with zero memory overhead.

Changes:

Rename open_file_mutex[] to node_mutex[] to reflect dual purpose
Add kernfs_node_lock_ptr() and kernfs_node_lock() helpers
Protect simple_xattr_set() calls in kernfs_xattr_set() and

kernfs_vfs_user_xattr_set() with the hashed mutex

Update file.c to use new helpers via compatibility wrappers
Update documentation to explain the extended lock usage

AnalysisAI

Race condition in the kernfs xattr subsystem of Linux kernel 7.1 and earlier allows local low-privileged users to corrupt shared xattr structures across multiple superblocks, resulting in high-impact confidentiality, integrity, and availability compromise. The flaw arises specifically in namespace-multiplexed environments where kernfs_test_super() allows distinct superblocks to share a single kernfs_node while VFS locking remains per-inode and therefore insufficient. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Obtain low-privilege local shell

Delivery

Enable or leverage existing user namespace access

Exploit

Mount kernfs from multiple namespaces sharing same kernfs_node

Install

Spawn concurrent threads issuing setxattr/removexattr across superblocks

Race non-atomic lookup-replace in simple_xattr_set()

Execute

Corrupt shared xattrs structure

Impact

Achieve privilege escalation or cross-namespace data disclosure

Recon

Obtain low-privilege local shell

Delivery

Enable or leverage existing user namespace access

Exploit

Mount kernfs from multiple namespaces sharing same kernfs_node

Install

Spawn concurrent threads issuing setxattr/removexattr across superblocks

Race non-atomic lookup-replace in simple_xattr_set()

Execute

Corrupt shared xattrs structure

Impact

Achieve privilege escalation or cross-namespace data disclosure

Vulnerability AssessmentAI

Exploitation	Exploitation requires a local user account with standard (low) privileges on a Linux system running kernel version 7.1 or earlier in the 7.x series (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local exploitation with low privileges and full-system impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A low-privileged local attacker on a Linux 7.1 host running a container runtime or Kubernetes node creates multiple user namespaces whose kernfs mounts resolve to shared kernfs_node entries. The attacker then spawns concurrent threads that simultaneously invoke setxattr and removexattr on the same kernfs-backed path from different namespace contexts, racing the non-atomic lookup-replace sequence inside simple_xattr_set() to corrupt the shared xattrs structure, potentially overwriting kernel memory or leaking sensitive xattr data from sibling namespaces. …
Remediation	The upstream fix is available via two stable kernel commits: https://git.kernel.org/stable/c/bf53db51359939755084d08156684ed649489592 and https://git.kernel.org/stable/c/6a07814ff643b5c8e1353d8c6229f52fde205cde. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, scan infrastructure for systems running Linux kernel 7.1 or earlier to establish patching scope and prioritize high-risk deployments. …

Threat intelligence, references, and detailed analysis are available after sign-in.