Linux Kernel CVE-2026-74601

Exploitation requires a local account with low privileges (PR:L per CVSS vector AV:L/AC:L/PR:L) on the target Linux system. The attacker must be able to interact with the kernel ring-buffer tracing subsystem - typically accessible via /sys/kernel/debug/tracing/ or through ftrace/perf APIs when debugfs is mounted. The exploitable race window exists specifically within rb_move_tail() during ring_buffer_lock_reserve() execution, requiring precise timing of an interrupt or concurrent CPU event to land between rb_end_commit() decrementing the committing counter and local_inc() re-incrementing it. Systems with kernel.perf_event_paranoid=3 or with debugfs unmounted significantly reduce exposure. The race is CPU-local, meaning exploitation requires influencing workload scheduling on a specific CPU. Remote unauthenticated exploitation is not possible - physical or SSH access with a local low-privilege account is the minimum precondition, further limited to systems where tracing interfaces are accessible to non-root users.

Despite a high NVD CVSS base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), real-world exploitation risk is substantially lower in practice. EPSS sits at 0.22% at the 13th percentile, indicating minimal observed exploitation pressure, and this CVE does not appear in the CISA KEV catalog. The C:H/I:H/A:H impact reflects worst-case kernel memory corruption, but realistic outcomes skew toward kernel warning or panic rather than controlled full-CIA compromise, unless an attacker can reliably leverage the corrupted buffer state for privilege escalation - a non-trivial secondary step. The NVD AC:L rating is likely optimistic: successfully landing the swap within the specific rb_move_tail() interrupt window in a production environment requires careful timing, more consistent with AC:H. The 'Authentication Bypass' tag in the intelligence data is misleading - this refers to bypassing the internal buffer-busy guard in ring_buffer_swap_cpu(), not any authentication control. The vulnerability is most relevant on multi-user Linux systems (shared hosting, container hosts where debugfs is mounted, HPC clusters) where local unprivileged users can interact with tracing interfaces. On single-user workstations or locked-down deployments with restricted debugfs access, the incremental risk is limited.

A local user with a low-privileged shell on a multi-user Linux system where debugfs is mounted and accessible initiates a process that repeatedly triggers ring buffer write operations via ftrace or similar tracing interfaces. Concurrently, the user arranges for an interrupt to fire - or leverages a second thread on the same CPU - during the brief committing=0 window in rb_move_tail(). If timed correctly, ring_buffer_swap_cpu() passes the guard check and exchanges the buffer mid-write, causing the original write's rb_commit() to operate on a stale cpu_buffer, triggering a kernel warning or panic, or in a more sophisticated exploitation chain, leveraging the corrupted buffer state for further memory manipulation. No public proof-of-concept exploit exists at time of analysis.