What is the CVSS score of CVE-2026-74446?

CVE-2026-74446 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74446?

CVE-2026-74446 is a privilege escalation vulnerability affecting Linux systems with AMD GPUs that could allow low-privileged users to bypass access controls and gain system-level privileges.. A patch is available.

How to fix or mitigate CVE-2026-74446?

Within 24 hours, inventory all systems with AMD GPUs running Linux and assess patch deployment feasibility with infrastructure teams. Within 7 days, deploy the available vendor patch to production AMD GPU systems according to your change management procedures, prioritizing systems with higher security sensitivity. Within 30 days, verify patch deployment across all affected systems and confirm through kernel auditing that vulnerable drm/amdkfd versions have been eliminated.

Linux Kernel CVE-2026-74446

EUVD-2026-59753 HIGH

2026-08-15 Linux

GHSA-3f2f-q78g-jqw3

Information Disclosure Linux Checkpoint Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition exploitation requires precise thread timing to win the count-to-walk IDR window, justifying AC:H over the NVD AC:L; AV:L and PR:L reflect mandatory local AMD GPU access.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:27 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:26 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 12:26 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: hold event_mutex while checkpointing CRIU events

kfd_criu_checkpoint_events() counts the entries in p->event_idr via kfd_get_num_events(), allocates an array sized to that count, and then walks the same IDR to fill it. Neither the count nor the walk holds p->event_mutex.

The CRIU checkpoint caller holds only p->mutex. Event create and destroy (kfd_event_create()/kfd_event_destroy()) take p->event_mutex and do not take p->mutex, so a second thread in the same process can insert or remove events between the count and the walk. If an event is inserted, the walk iterates more entries than were counted and writes past the end of the ev_privs allocation; if an event is removed, the walk dereferences an entry that is being freed.

Hold p->event_mutex across the count and the walk so both observe a consistent view of p->event_idr. The lock is released before copy_to_user(), which only touches the local buffer. The caller already holds p->mutex and the create/destroy paths never take p->mutex, so the p->mutex -> p->event_mutex order is not inverted and no deadlock is introduced.

(cherry picked from commit ff57e223ab105795b05d3ef3f3c35a5a441bcbaa)

AnalysisAI

Concurrent event manipulation during CRIU checkpointing in the Linux kernel's AMD GPU driver (drm/amdkfd) exposes a race condition leading to heap out-of-bounds writes or use-after-free memory corruption. A low-privileged local attacker on a system with an AMD GPU can exploit the unprotected gap between the event count and IDR walk in kfd_criu_checkpoint_events() by racing event creation or destruction from a second thread within the same process, producing kernel heap corruption primitives exploitable for local privilege escalation. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Obtain low-privilege local account with /dev/kfd access

Delivery

Initialize AMD KFD process owning multiple events

Exploit

Spawn concurrent thread racing event create/destroy operations

Install

Trigger CRIU checkpoint call without event_mutex held

Win TOCTOU race during count-to-walk window

Execute

Trigger heap OOB write or use-after-free in kernel heap

Impact

Leverage memory corruption primitive for local privilege escalation to root

Recon

Obtain low-privilege local account with /dev/kfd access

Delivery

Initialize AMD KFD process owning multiple events

Exploit

Spawn concurrent thread racing event create/destroy operations

Install

Trigger CRIU checkpoint call without event_mutex held

Win TOCTOU race during count-to-walk window

Execute

Trigger heap OOB write or use-after-free in kernel heap

Impact

Leverage memory corruption primitive for local privilege escalation to root

Vulnerability AssessmentAI

Exploitation	Exploitation requires all of the following specific conditions: (1) an AMD GPU present on the target system with the drm/amdkfd kernel module loaded and functional; (2) a low-privilege local user account with read-write access to /dev/kfd - typically granted via membership in the 'render' group or equivalent udev-managed group, which is non-default for arbitrary local users but standard for GPU compute users; (3) the ability to initiate a CRIU checkpoint of a process that owns KFD events; (4) concurrent ability to call kfd_event_create() or kfd_event_destroy() from a second thread within the same process during the checkpoint window. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-assigned CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) rates this as High severity with low attack complexity, but the AC:L rating is independently disputed here: exploiting a kernel TOCTOU race requires precise thread scheduling to win the count-to-walk window, which aligns more accurately with AC:H in standard race-condition exploit practice - operators should verify this assessment against any supplemental vendor guidance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local attacker with a low-privilege account on a Linux system with an AMD GPU initializes a KFD process that owns multiple events, then spawns a second thread that rapidly and continuously creates and destroys KFD events. Simultaneously, the attacker initiates a CRIU checkpoint of the process, and by winning the race between kfd_get_num_events() and the subsequent IDR fill walk, triggers either a heap out-of-bounds write (if an event is inserted in the window) or a use-after-free (if an event is removed), providing kernel memory corruption primitives for a subsequent local privilege escalation to root. …
Remediation	Upgrade to a patched Linux kernel release: 6.6.151, 6.12.103, or 6.18.44 for LTS stable series users, 7.1.8 for the 7.1 series, or 7.2-rc6 for mainline tracking. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all systems with AMD GPUs running Linux and assess patch deployment feasibility with infrastructure teams. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Checkpoint

View all

CVE-2024-24919 HIGH Act Now POC

8.6 May 28

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte

CVE-2017-1000083 HIGH Act Now POC

7.8 Sep 05

backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e

CVE-2026-16232 CRITICAL Emergency POC

9.3 Jul 22

Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid

CVE-2024-3568 CRITICAL Act Now POC

9.6 Apr 10

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data

CVE-2026-24747 HIGH This Week POC

8.8 Jan 27

PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]

CVE-2022-41604 HIGH This Week POC

8.8 Sep 27

Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever

CVE-2026-58659 HIGH This Week POC

8.4 Jul 15

Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che

CVE-2019-8461 HIGH This Week POC

7.8 Aug 29

Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo

CVE-2019-8452 HIGH This Week POC

7.8 Apr 22

A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien

CVE-2026-69112 MEDIUM This Month POC

6.9 Aug 10

Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte

CVE-2026-68447 HIGH Act Now

7.1 Aug 12

Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with

CVE-2013-7350 CRITICAL Act Now

10.0 Apr 01

Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-74446 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74446

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in Checkpoint

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code