What is the CVSS score of CVE-2026-74405?

CVE-2026-74405 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74405?

CVE-2026-74405 affects Linux kernel systems in cloud and infrastructure environments that use Dynamic Voltage and Frequency Scaling, with vulnerable versions spanning 4.11 through early 7.1.x and…. A patch is available.

How to fix or mitigate CVE-2026-74405?

Within 24 hours, identify all systems running Linux kernels 4.11 through versions predating 7.1.5 and 6.18.40 using automated kernel version audits and asset management tools; prioritize internet-facing and multi-tenant systems. Within 7 days, deploy kernel updates to 7.1.5, 6.18.40, or later stable branches to development and staging environments, verifying system stability and DVFS functionality after patching. Within 30 days, complete production rollout using a phased approach that prioritizes DVFS-enabled systems and sensitive workloads, with thorough testing and documented rollback procedures before each phase.

Linux Kernel CVE-2026-74405

EUVD-2026-59552 HIGH

2026-08-15 Linux

GHSA-5fpw-5c2c-j4pp

Information Disclosure Linux Red Hat

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition exploitation requires precise concurrent timing (AC:H); AV:L and PR:L confirmed by local-only OPP subsystem access requirement.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:06 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 07:19 EUVD

CVE Published

Aug 15, 2026 - 05:59 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 05:59 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

OPP: Fix race between OPP addition and lookup

A race exists between dev_pm_opp_add_dynamic() and dev_pm_opp_find_freq_exact():

CPU0 (add) CPU1 (lookup) ------------------------------- ------------------------------ _opp_add() mutex_lock() list_add(&new_opp->node, head) mutex_unlock() _opp_table_find_key() mutex_lock() dev_pm_opp_get(opp) kref_get() mutex_unlock() kref_init(&new_opp->kref) dev_pm_opp_put() kref_put_mutex()

The newly added OPP is inserted into the list before its kref is initialized. A concurrent lookup can find this OPP and increment its reference count while it is still uninitialized, leading to refcount corruption and a potential premature free.

Fix this by initializing ->kref and ->opp_table before making the OPP visible via list_add(). This ensures any concurrent lookup observes a fully initialized object.

[ Viresh: Updated commit log ]

AnalysisAI

Reference count corruption in the Linux kernel's Operating Performance Points (OPP) subsystem exposes systems to memory corruption and potential privilege escalation via a race condition between OPP object addition and frequency lookup. Affected kernels from 4.11 through stable branches predating commits to 7.1.5 and 6.18.40 are vulnerable when concurrent DVFS (Dynamic Voltage and Frequency Scaling) operations race during OPP table construction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Obtain local shell on OPP-active ARM system

Delivery

Spawn concurrent OPP-add and OPP-lookup threads

Exploit

Race list_add() before kref_init() completes

Install

Lookup thread calls kref_get() on uninitialized kref

Corrupt reference count, trigger premature free

Execute

Leverage use-after-free for kernel memory write

Impact

Escalate to root

Recon

Obtain local shell on OPP-active ARM system

Delivery

Spawn concurrent OPP-add and OPP-lookup threads

Exploit

Race list_add() before kref_init() completes

Install

Lookup thread calls kref_get() on uninitialized kref

Corrupt reference count, trigger premature free

Execute

Leverage use-after-free for kernel memory write

Impact

Escalate to root

Vulnerability AssessmentAI

Exploitation	Exploitation requires a local account with sufficient privilege to interact with the OPP subsystem (PR:L per CVSS), meaning an unprivileged shell user on most Linux configurations. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 (High), reflecting local authenticated exploitation with full impact across confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local low-privileged user on an ARM-based Linux system (e.g., an embedded device or SBC running kernel 6.x or 7.x pre-patch) spawns two threads: one repeatedly calls into the OPP subsystem to add performance points (via a driver or sysfs interface), while a second thread concurrently enumerates available OPP frequencies. By winning the race window between list_add() and kref_init() in the kernel, the lookup thread obtains a pointer to an uninitialized OPP object and increments its reference count, corrupting the kref state and triggering a premature free. …
Remediation	The primary fix is to upgrade to a patched kernel release: 7.1.5 or later for the 7.1.x stable series, 6.18.40 or later for the 6.18.x series, or 7.2-rc1 or later for the development branch. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all systems running Linux kernels 4.11 through versions predating 7.1.5 and 6.18.40 using automated kernel version audits and asset management tools; prioritize internet-facing and multi-tenant systems. …

Threat intelligence, references, and detailed analysis are available after sign-in.