Skip to main content

Linux Kernel CVE-2026-74512

| EUVDEUVD-2026-59705 HIGH
2026-08-15 Linux GHSA-4248-7w5j-8g9p
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition between deletion and RCU reader paths raises AC to H; PR:L and AV:L confirmed by local-only access requirement.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.4 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 11:59 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

audit: fix potential use-after-free in audit_del_rule()

audit_del_rule() destroys e->rule.exe via audit_remove_mark_rule() before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in audit_filter() and audit_filter_rules() still dereference e->rule.exe, while the fsnotify mark can be freed on an independent lifetime path. This creates a use-after-free window during rule deletion.

Fix this by unlinking the rule from the RCU-visible lists and invoking synchronize_rcu() before calling audit_remove_mark_rule() (and other rule removal helpers). This ensures that all existing RCU readers have exited the critical section before any underlying resources are destroyed.

AnalysisAI

Use-after-free in the Linux kernel audit subsystem's audit_del_rule() function exposes systems from kernel 4.3 onward to local privilege escalation. The flaw stems from incorrect RCU ordering: fsnotify mark resources tied to e->rule.exe are freed before the rule is unlinked from RCU-visible filter lists, creating a window where concurrent audit_filter() and audit_filter_rules() readers dereference already-freed memory. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain local low-privilege shell
Delivery
Configure or await active fsnotify-based audit rule
Exploit
Trigger concurrent audit rule deletion
Execution
Race audit_filter() reader dereference
Persist
Use-after-free kernel memory access
Impact
Escalate to root via kernel structure corruption
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The Linux kernel audit subsystem must be active, meaning auditd must be running and audit rules referencing executable path watches (fsnotify marks) must be configured - systems with no active audit rules or with auditd disabled are not exploitable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects the high potential impact of kernel-level memory corruption - full confidentiality, integrity, and availability compromise - but the local attack vector and low-privilege requirement substantially limit real-world exposure compared to network-accessible vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A local attacker with a low-privileged shell account on a Linux system running auditd causes concurrent deletion of an audit rule that references an executable watch (fsnotify mark) while another kernel thread is simultaneously evaluating filter rules in `audit_filter()`. If the deletion thread frees the fsnotify mark via `audit_remove_mark_rule()` before the reader dereferences `e->rule.exe`, the attacker achieves a use-after-free read or write in kernel space, which can be leveraged to corrupt kernel structures and escalate privileges to root. …
Remediation The primary remediation is upgrading to a patched Linux kernel version: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Linux systems and kernel versions in your infrastructure, prioritizing production servers and those with multiple user accounts. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-74512 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy