What is the CVSS score of CVE-2026-74490?

CVE-2026-74490 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74490?

A high-severity Linux kernel vulnerability (CVE-2026-74490, CVSS 8.8) allows users with system access to escalate privileges and gain administrative control.. A patch is available.

How to fix or mitigate CVE-2026-74490?

Within 24 hours, identify and document all systems running affected Linux kernel versions (6.6 prior to 6.6.151, 6.12 prior to 6.12.103, 6.18 prior to 6.18.44, and 7.1 prior to 7.1.8) and prioritize those with active user logins or untrusted workload execution. Within 7 days, begin kernel patching for critical systems, upgrading to fixed versions 6.6.151, 6.12.103, 6.18.44, or 7.1.8 as appropriate to your environment. Within 30 days, complete patching of all remaining affected systems and validate kernel version compliance through your asset management system.

Linux Kernel CVE-2026-74490

EUVD-2026-59683 HIGH

2026-08-15 Linux

GHSA-5445-w6x8-6hfq

Information Disclosure Linux Red Hat Suse

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local vector because exploitation requires a local TIPC socket in poll(); AC:H for the inherent race condition timing requirement; PR:L for low-privileged socket access; full C/I/A impact reflects kernel-level UAF potential.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

4.7 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:48 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tipc: avoid use-after-free in poll trace queue dumps

TIPC socket tracepoints dump queue state through tipc_sk_dump(). Most queue-dump callsites already serialize that walk under the socket lock or sk->sk_lock.slock, but tipc_poll() calls trace_tipc_sk_poll(..., TIPC_DUMP_ALL, ...) without holding either lock.

That lets the poll trace path reach tipc_list_dump() and backlog head/tail dumping while another context dequeues and frees an skb, leaving the trace helper dereferencing a stale queue entry.

Stop the unlocked poll trace site from requesting queue dumps. Other queue dump trace callsites keep their existing output under the locking they already provide, while poll still emits the event itself without walking live queue members from an unlocked context.

AnalysisAI

Use-after-free race condition in the Linux Kernel TIPC subsystem allows a low-privileged attacker to trigger stale-pointer dereference during socket poll trace operations, potentially leading to kernel memory corruption and privilege escalation. The flaw arises because tipc_poll() invokes trace_tipc_sk_poll() without holding the socket lock, enabling tipc_list_dump() to walk live queue members while a concurrent thread dequeues and frees socket buffers (skbs). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Gain low-privileged local account on TIPC-enabled kernel

Delivery

Open TIPC socket and enter continuous poll() loop

Exploit

Generate concurrent inbound TIPC traffic or spawn thread dequeuing skbs

Execution

Race tipc_poll() trace path to reach tipc_list_dump() without socket lock

Persist

Dereference freed skb pointer in trace helper

Impact

Corrupt kernel heap or leak kernel addresses for privilege escalation

Access

Gain low-privileged local account on TIPC-enabled kernel

Delivery

Open TIPC socket and enter continuous poll() loop

Exploit

Generate concurrent inbound TIPC traffic or spawn thread dequeuing skbs

Execution

Race tipc_poll() trace path to reach tipc_list_dump() without socket lock

Persist

Dereference freed skb pointer in trace helper

Impact

Corrupt kernel heap or leak kernel addresses for privilege escalation

Vulnerability AssessmentAI

Exploitation	Exploitation requires the TIPC kernel module (CONFIG_TIPC) to be loaded and active - TIPC is not loaded by default in most general-purpose Linux distributions (Debian, Ubuntu, Fedora, RHEL), limiting exposure primarily to telecom, cluster, or high-availability middleware environments where TIPC is explicitly configured. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-assigned CVSS vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High) materially overstates exploitation ease for this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with a low-privileged account on a Linux system running TIPC-based cluster software opens a TIPC socket and enters a tight poll() loop to continuously trigger the trace_tipc_sk_poll() code path. Simultaneously - either via inbound TIPC cluster network traffic or a cooperating local thread - the TIPC network stack dequeues and frees socket buffers concurrently, creating a race window during which tipc_list_dump() walks the queue without the socket lock and dereferences a freed skb. …
Remediation	Upgrade to a patched Linux kernel version: 6.6.151 or later in the 6.6.x LTS branch, 6.12.103 or later in the 6.12.x LTS branch, 6.18.44 or later in the 6.18.x branch, 7.1.8 or later in the 7.1.x branch, or mainline 7.2-rc6 and beyond. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and document all systems running affected Linux kernel versions (6.6 prior to 6.6.151, 6.12 prior to 6.12.103, 6.18 prior to 6.18.44, and 7.1 prior to 7.1.8) and prioritize those with active user logins or untrusted workload execution. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-74490 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74490

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code