Skip to main content

Linux Kernel CVE-2026-74515

| EUVDEUVD-2026-59708 HIGH
2026-08-15 Linux GHSA-269x-pqmw-g2f4
Information Disclosure Linux Red Hat Suse
High
Disputed · 8.8 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Local access and low privilege required to call the ioctl; scope change justified by guest-to-hypervisor memory corruption crossing the KVM isolation boundary.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:00 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: pci: Reject adapter interrupt forwarding if already enabled

The MPCIFC instruction doesn't allow registering adapter interrupts without first unregistering. So reject any request to enable interrupt forwarding if its already enabled for the zPCI device. This also fixes overwriting and thus leaking resources when the ioctl is called multiple times for the same device.

AnalysisAI

KVM s390 PCI subsystem in the Linux kernel allows a local low-privileged user to corrupt hypervisor resources by repeatedly calling the adapter interrupt forwarding ioctl for the same zPCI device without prior unregistration. The vulnerability affects IBM Z (s390) systems running Linux KVM with PCI passthrough from commit 3c5a1b6f onwards (Linux 6.0+), with patched stable releases available. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege local access on IBM Z KVM host or guest
Delivery
Identify zPCI device with adapter interrupt forwarding configured
Exploit
Invoke adapter interrupt enable ioctl repeatedly for same device
Execution
Bypass missing state check, overwrite kernel resource structure
Persist
Corrupt or leak hypervisor memory
Impact
Achieve scope change impacting host kernel integrity
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires: (1) IBM Z (s390) architecture - no other architecture is affected; (2) Linux kernel 6.0 or later with the vulnerable commit present; (3) KVM hypervisor running with at least one zPCI (z Systems PCI Express) device configured for adapter interrupt forwarding passthrough to a guest; (4) local low-privilege access (PR:L per CVSS) to call the relevant KVM ioctl, either from within a guest with appropriate device access or directly on the host. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 8.8 score with S:C (Scope Changed) reflects the theoretical worst case - a guest escaping into the host hypervisor via memory corruption - and is the primary driver of headline severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A low-privilege local user on an IBM Z system hosting KVM guests with zPCI PCI passthrough opens the KVM ioctl interface and repeatedly issues adapter interrupt forwarding enable commands for the same zPCI device without intervening disable calls. Each successive call overwrites the existing kernel resource structure for that device without freeing the prior allocation, corrupting kernel memory in the hypervisor context. …
Remediation Upgrade the Linux kernel to a patched stable release: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6, applying the appropriate commit from the kernel stable trees at https://git.kernel.org/stable/c/78d9648e7e960546d5b72504a0b0358cd8bb1e9d (and the four sibling commits referenced in the CVE). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, determine whether your organization operates IBM Z mainframes running Linux KVM with PCI passthrough enabled and identify all systems running Linux 6.0 or later. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-74515 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy