What is the CVSS score of CVE-2026-74479?

CVE-2026-74479 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74479?

CVE-2026-74479, a high-severity use-after-free vulnerability in the Linux kernel's pktgen testing module, could enable local attackers to escalate privileges or crash affected systems.. A patch is available.

How to fix or mitigate CVE-2026-74479?

Within 24 hours, audit Linux systems to identify whether the pktgen kernel module is enabled (prioritize development and test environments). Within 7 days, obtain the patched kernel version from the vendor security advisory and begin staged rollout of updates, starting with non-production systems. Within 30 days, complete kernel patching across all pktgen-enabled systems, verify functionality post-patch, and disable the pktgen module on production systems where it is not actively used.

Linux Kernel CVE-2026-74479

EUVD-2026-59672 HIGH

2026-08-15 Linux

GHSA-34c4-h856-x83p

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition exploitation requires precise multi-CPU timing and a widened window, warranting AC:H over the NVD-assigned AC:L; all other metrics retained.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

6.4 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:42 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: pktgen: fix proc entry use-after-free

pktgen_change_name() replaces pkt_dev->entry while holding t->if_lock. pktgen_remove_device() removes the same entry before _rem_dev_from_if_list() takes that lock.

This allows the following interleaving:

CPU 0 (NETDEV_CHANGENAME) CPU 1 (kpktgend) if_lock(t) proc_remove(pkt_dev->entry) proc_remove(pkt_dev->entry) pkt_dev->entry = proc_create_data(...) if_unlock(t)

The kthread can pass the stale proc_dir_entry to proc_remove() after the rename path has freed it. A reproducer with a widened race window reports:

BUG: KASAN: slab-use-after-free in proc_remove+0x78/0x80 Read of size 8 at addr ffff8881478fea70 by task kpktgend_0/67 Call Trace: proc_remove+0x78/0x80 pktgen_remove_device.isra.0+0x11c/0x4c0 pktgen_thread_worker+0x1214/0x6bc0 kthread+0x2c6/0x3b0 Allocated by task 95: __proc_create+0x204/0x790 proc_create_data+0x72/0xe0 pktgen_thread_write+0xd61/0x1510 Freed by task 28: kmem_cache_free+0xcb/0x3d0 proc_free_inode+0x5b/0x80 rcu_core+0x50a/0x1850 The buggy address belongs to the object at ffff8881478fea00 which belongs to the cache proc_dir_entry of size 192

Move proc_remove() into the if_lock-protected list removal helper. Keep it before list_del_rcu() to preserve the ordering required by add_device(). The rename path must then finish replacing the entry before removal, or it observes that the device is no longer on the list.

AnalysisAI

Use-after-free in the Linux kernel pktgen subsystem exposes local attackers with low privileges to kernel memory corruption, potential privilege escalation, or system crash. The flaw arises from a race condition between pktgen_change_name() and pktgen_remove_device() on a shared proc_dir_entry pointer, allowing a kpktgend kernel thread to dereference a stale, freed pointer after a concurrent rename operation releases it. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Gain local low-privilege system access

Delivery

Confirm or trigger pktgen module load

Exploit

Interact with /proc/net/pktgen/ interface

Install

Trigger concurrent device rename and removal across two CPUs

Race proc_dir_entry TOCTOU window past if_lock boundary

Execute

Use-after-free in kernel slab cache

Impact

Escalate privileges or crash kernel

Recon

Gain local low-privilege system access

Delivery

Confirm or trigger pktgen module load

Exploit

Interact with /proc/net/pktgen/ interface

Install

Trigger concurrent device rename and removal across two CPUs

Race proc_dir_entry TOCTOU window past if_lock boundary

Execute

Use-after-free in kernel slab cache

Impact

Escalate privileges or crash kernel

Vulnerability AssessmentAI

Exploitation	Exploitation requires local access to a Linux system with the pktgen kernel module actively loaded in memory (CONFIG_NET_PKTGEN compiled and module present). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-assigned CVSS 3.1 score of 7.8 (High) with AV:L/AC:L/PR:L merits scrutiny: the AC:L designation conflicts with the race-condition nature of the flaw, which requires precise multi-CPU timing to exploit reliably. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local attacker with a standard user account on a Linux development or networking lab system where the pktgen module is loaded triggers simultaneous NETDEV_CHANGENAME and pktgen device removal operations on a pktgen network interface across two CPU cores. By racing the two kernel paths, the attacker causes the kpktgend kernel thread to call proc_remove() on a proc_dir_entry pointer that the rename path has already freed, achieving a slab-use-after-free that can be used for kernel memory corruption or privilege escalation. …
Remediation	Upgrade to Linux kernel 6.18.44, 7.1.8, or 7.2-rc6 or later, which incorporate the upstream fix commits: 4ef801b838d85c0ea5852c50667f7344ce3b6cd0 (https://git.kernel.org/stable/c/4ef801b838d85c0ea5852c50667f7344ce3b6cd0), b006a5404470bd3eb2aa0425fc447183032047ef (https://git.kernel.org/stable/c/b006a5404470bd3eb2aa0425fc447183032047ef), and 817ff6efdb7f484ea547218e11e17d8e43daa3b4 (https://git.kernel.org/stable/c/817ff6efdb7f484ea547218e11e17d8e43daa3b4). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit Linux systems to identify whether the pktgen kernel module is enabled (prioritize development and test environments). …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-74479 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74479

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code