What is the CVSS score of CVE-2026-74471?

CVE-2026-74471 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74471?

A use-after-free vulnerability in the Linux kernel tracing subsystem (CVE-2026-74471) allows any local user on an affected system to escalate privileges to root through kernel memory corruption.. A patch is available.

How to fix or mitigate CVE-2026-74471?

Within 24 hours, identify all Linux systems running vulnerable kernels and assess which have users who could trigger a local attack, prioritizing multi-user or container environments. Within 7 days, deploy patched kernel versions from the vendor (available for multiple stable branches) to development and staging systems, validating application stability before production rollout. Within 30 days, complete kernel updates on all affected production systems, ensuring all systems are rebooted to activate the patched kernel.

Linux Kernel CVE-2026-74471

EUVD-2026-59664 HIGH

2026-08-15 Linux

GHSA-437h-q69x-6qrx

Information Disclosure Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

AC:H reflects that triggering the bug requires a specific module-load failure sequence followed by a tracefs access; all other metrics align with NVD assessment.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:38 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tracing: Check return value of __register_event() in trace_module_add_events()

trace_module_add_events() ignores the return value of __register_event() and unconditionally calls __add_event_to_tracers() for each event.

If __register_event() fails (for example, if event_init() fails), the trace_event_call is not added to ftrace_events list, but __add_event_to_tracers() still creates a trace_event_file pointing to it. If module loading subsequently fails and module memory is freed, tracing state retains a stale trace_event_call pointer in trace_event_file, leading to a use-after-free when tracefs or tracing subsystem operations are later executed.

Fix this by checking the return value of __register_event() and only calling __add_event_to_tracers() if event registration succeeded.

AnalysisAI

Use-after-free in the Linux kernel tracing subsystem exposes low-privileged local attackers to kernel memory corruption and potential privilege escalation. The defect, introduced at commit ae63b31e4d0e2ec09c569306ea46f664508ef717, causes trace_module_add_events() to call __add_event_to_tracers() unconditionally even when __register_event() has failed, leaving a trace_event_file holding a dangling pointer to a freed trace_event_call after a module load failure. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Obtain local low-privilege shell access

Delivery

Load crafted module with trace events causing event_init() failure

Exploit

Module load fails, kernel frees module memory

Install

Stale trace_event_file pointer retained in tracing subsystem

Access tracefs file to trigger use-after-free dereference

Execute

Achieve kernel heap corruption

Impact

Escalate to root

Recon

Obtain local low-privilege shell access

Delivery

Load crafted module with trace events causing event_init() failure

Exploit

Module load fails, kernel frees module memory

Install

Stale trace_event_file pointer retained in tracing subsystem

Access tracefs file to trigger use-after-free dereference

Execute

Achieve kernel heap corruption

Impact

Escalate to root

Vulnerability AssessmentAI

Exploitation	Exploitation requires: (1) local authenticated access to the target system with at minimum CAP_SYS_MODULE or an equivalent capability that permits kernel module loading - on default Linux systems this typically requires root or an explicitly granted capability, though unprivileged user namespaces (enabled by default on Ubuntu and some container runtimes) may lower this bar; (2) the kernel tracing subsystem must be accessible (tracefs mounted, kernel.ftrace_enabled=1 - default on most distributions); (3) the attacker must be able to supply or trigger a module whose event_init() fails during trace_module_add_events() processing, followed by a subsequent access to a tracing file path before the freed memory is reclaimed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a kernel-space memory corruption scenario reachable by a local user with low privileges, which is broadly consistent with the described mechanism - the attacker needs only the ability to trigger module loading. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A low-privileged local user or containerized process with CAP_SYS_MODULE capability triggers loading of a crafted kernel module that declares trace events but is designed to fail during event_init(). The failed registration leaves a dangling trace_event_file in the tracing subsystem; a subsequent read or write to a tracefs file (e.g., /sys/kernel/tracing/events/) dereferences the freed trace_event_call, allowing an attacker to achieve controlled kernel heap corruption potentially leading to privilege escalation. …
Remediation	Upgrade to a patched Linux kernel: 6.6.151 or later on the 6.6 LTS branch, 6.12.103 or later on the 6.12 LTS branch, 6.18.44 or later on the 6.18 branch, or 7.1.8 or later on the 7.1 branch. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all Linux systems running vulnerable kernels and assess which have users who could trigger a local attack, prioritizing multi-user or container environments. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-74471 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74471

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code