Skip to main content

Linux Kernel CVE-2026-74495

| EUVDEUVD-2026-59688 CRITICAL
2026-08-15 Linux GHSA-7vcq-2p5f-22mh
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Low–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
2.5 LOW

Local TX datapath leak needing a rare, non-attacker-controlled DMA failure (AV:L/AC:H), local privilege to drive traffic (PR:L); only gradual availability impact, no confidentiality or integrity effect.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 11:50 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

igbvf: Fix leak in TX DMA error cleanup

If an error is encountered while mapping TX buffers, the driver should unmap any buffers already mapped for that skb.

Because count is incremented before each frag mapping, it will always match the correct number of unmappings needed when dma_error is reached. Decrementing count before the while loop in dma_error causes an off-by-one error. If any mapping was successful before an unsuccessful mapping, exactly one DMA mapping (the head) would leak.

This bug was introduced by a 2010 fix for an endless loop in dma_error. All other affected drivers have already been fixed.

AnalysisAI

A DMA mapping resource leak in the Linux kernel's igbvf driver (Intel 82576 SR-IOV virtual function NIC) occurs on the TX buffer-mapping error path: an off-by-one in the dma_error cleanup loop leaks exactly one DMA mapping (the packet head) whenever a fragment mapping fails after the head was successfully mapped. The bug traces to a 2010 fix for an endless loop and affects a wide range of stable kernels until patched (fixes landed in 6.6.151, 6.12.103, 6.18.44, 7.1.8 and 7.2-rc6). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Local access to host running igbvf on Intel VF NIC
Delivery
Generate sustained multi-fragment TX traffic
Exploit
Trigger DMA mapping failure mid-skb
Execution
Head DMA mapping leaks on error path
Impact
Cumulative DMA/memory exhaustion degrades system
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires the igbvf driver to be loaded and actively transmitting on Intel 82576-class virtual-function NICs, and a TX DMA mapping failure must occur for a multi-buffer skb where the head plus at least one fragment were mapped before a later fragment fails - only then does the head mapping leak. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals conflict sharply. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario On a virtualization host using Intel 82576 SR-IOV VFs, sustained transmit load coincides with DMA mapping failures (e.g., under IOMMU/memory pressure), and each failed multi-fragment skb leaks the head DMA mapping. Over time these leaks accumulate and degrade the driver/host until the interface or system runs low on DMA resources. …
Remediation Apply the vendor-released stable kernel patches: upgrade to 6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6 or later on the corresponding branch, using your distribution's backported kernel where applicable; the fixes are at https://git.kernel.org/stable/c/31089f4eab42e0fc248ec80c26f9b0bad59ba4cc and the sibling commits (bc25d56c03e4, 845a9cdd9b03, df07003b5a6c, 0565052b7e2f). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Linux systems using Intel 82576 SR-IOV virtual function NICs and verify which are running kernel versions prior to 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-74495 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy