Skip to main content

Linux Kernel CVE-2026-74567

| EUVDEUVD-2026-59632 HIGH
2026-08-15 Linux GHSA-fp4g-wh5w-9xf4
Buffer Overflow Linux Red Hat Suse
7.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
6.3 MEDIUM

Multi-level hash collision requirement across four keyring tree levels warrants AC:H; local syscall invocation and unprivileged trigger confirm AV:L and PR:L; no integrity impact observed.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:30 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.1 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:28 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:28 cve.org
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

keys: fix out-of-bounds read in keyring_get_key_chunk()

For description-level chunks keyring_get_key_chunk() advances the read pointer by level * sizeof(long) past the inline prefix but only bounds-checks the prefix, so a long enough key description is read past its kmemdup(desc, desc_len + 1) allocation. Compute the full byte offset and bounds-check the description against it before reading.

The walk only reaches a description-level chunk when two keys collide through the hash, x, type and domain_tag chunks, so this is reached from an unprivileged add_key(2) with a crafted pair of same-type keys whose index hashes collide; KASAN reports a slab-out-of-bounds read.

AnalysisAI

Out-of-bounds slab read in the Linux kernel keyring subsystem's keyring_get_key_chunk() exposes kernel heap memory and enables potential kernel crashes from any unprivileged local user account. Affected kernels fail to bounds-check the full computed byte offset when walking description-level key chunks, allowing reads past a kmemdup-allocated buffer. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain unprivileged local user shell
Delivery
Craft two same-type keys with engineered multi-level hash collisions
Exploit
Call add_key(2) to insert both keys
Execution
Trigger keyring tree walk to description-level chunk
Persist
Out-of-bounds slab read executes
Impact
Leak adjacent kernel heap memory or crash kernel
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a local user account with the ability to invoke the add_key(2) syscall, which is permitted to all unprivileged users by default on standard Linux distributions. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, score 7.1) indicates local, low-complexity, low-privilege exploitation with high confidentiality and availability impacts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unprivileged attacker with a local shell account calls add_key(2) twice with same-type keys engineered so their index hashes collide through the hash, x, type, and domain_tag levels of the keyring tree, forcing keyring_get_key_chunk() to enter the description-level walk. The unchecked offset read past the kmemdup allocation leaks adjacent kernel slab contents - potentially exposing keys, kernel pointers, or cryptographic material - and may panic the kernel, causing a denial of service. …
Remediation Upgrade the Linux kernel to a patched stable release: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6 (or later), selecting the branch that matches the current deployment; upstream fix commits are available at the kernel stable tree (https://git.kernel.org/stable/c/). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Linux systems and document current kernel versions across production, staging, and development environments. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-74567 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy