What is the CVSS score of EUVD-2026-59432?

EUVD-2026-59432 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-59432?

A local privilege escalation vulnerability in Linux kernel versions 7.1 and earlier allows users with standard system access to gain administrative control through kernel memory corruption…. A patch is available.

How to fix or mitigate EUVD-2026-59432?

Within 24 hours, inventory all Linux servers running kernel version 7.1 or earlier and assess the distribution across production, staging, and development environments. Within 7 days, apply kernel updates to version 7.1.5 or 7.2-rc1 (depending on your distribution) to all affected systems, prioritizing production and systems with untrusted local access. Within 30 days, complete rollout across all infrastructure and verify through inventory scanning that no affected kernel versions remain in production.

Linux Kernel EUVD-2026-59432

| CVE-2026-74285 HIGH

2026-08-15 Linux

GHSA-v8cx-r8w6-r2xr

Information Disclosure Linux Red Hat

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

AC:H reflects non-default netkit zcrx configuration and narrow teardown race window; S:C and full impact retained given DMA corruption beyond process boundary.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 10:13 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:57 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 05:57 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: Stop leased rxq before uninstalling its memory provider

netif_rxq_cleanup_unlease() tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA mappings before stopping the physical queue:

__netif_mp_uninstall_rxq(virt_rxq, p); /* DMA unmap */ __netif_mp_close_rxq(phys_rxq->dev, rxq_idx, p); /* queue stop */

This inverts the ordering used by the regular teardown paths (normal device unregister and the io_uring zcrx close path), which stop the queue before revoking the provider's mappings.

With the physical queue still live, its NAPI can keep consuming net_iov entries from the page_pool alloc cache after the __netif_mp_uninstall_rxq() has already cleared their dma_addr, opening a window for the device to DMA to a stale or zero address.

Fix it by swapping the two calls so the queue is stopped (and its NAPI quiesced) before the provider is uninstalled. No functional regression was observed across repeated runs of the nk_qlease.py HW selftest, which exercises the lease teardown path; this was tested against fbnic QEMU emulation.

AnalysisAI

Incorrect teardown ordering in the Linux kernel's netkit queue lease subsystem allows a local attacker with low privileges to trigger a race window where live NAPI polling consumes net_iov entries whose DMA addresses have already been cleared, causing the physical NIC to DMA to a stale or zero address. Affected kernel versions span from the introducing commit 5602ad61ebee through the 7.1 stable series, with fixes landing in 7.1.5 and 7.2-rc1. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain low-privilege shell access

Delivery

Confirm netkit queue lease with zcrx memory provider is active

Exploit

Initiate or race lease teardown (close io_uring context)

Execution

DMA address cleared while NAPI still polling

Persist

NIC writes packet data to stale/zero physical address

Impact

Kernel memory corruption enabling privilege escalation

Access

Obtain low-privilege shell access

Delivery

Confirm netkit queue lease with zcrx memory provider is active

Exploit

Initiate or race lease teardown (close io_uring context)

Execution

DMA address cleared while NAPI still polling

Persist

NIC writes packet data to stale/zero physical address

Impact

Kernel memory corruption enabling privilege escalation

Vulnerability AssessmentAI

Exploitation	Exploitation requires three concurrent conditions: (1) the target system must have a netkit virtual network device configured with a queue lease that installs a memory provider on a physical NIC's RX queue - this is a non-default, explicitly configured deployment using io_uring zero-copy receive (zcrx); (2) the attacker must have low-privilege local access sufficient to interact with the io_uring/netkit context or otherwise trigger the lease teardown code path; and (3) exploitation depends on a narrow race window that exists only during the teardown of the lease, requiring timing alignment between the DMA unmap and active NAPI polling on the physical queue. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a high-severity local vulnerability with scope change - the scope change (S:C) is the most operationally significant signal here, indicating that memory corruption via mis-directed DMA can affect system components outside the vulnerable process, including kernel memory of other processes or hypervisor state. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A low-privileged local user on a server running an io_uring zero-copy RX workload with a netkit virtual device triggers or races the lease teardown path - for example by closing the io_uring context while the physical NIC's NAPI is actively polling. During the brief window between DMA address invalidation and queue quiescence, the NIC's hardware DMA engine writes received packet data to the now-zero or stale physical address, potentially corrupting kernel memory mapped at that address. …
Remediation	The primary fix is to upgrade to Linux kernel 7.1.5 or 7.2-rc1 (or later), which swap the two cleanup calls in netif_rxq_cleanup_unlease() so the physical queue is stopped via __netif_mp_close_rxq() before DMA mappings are revoked via __netif_mp_uninstall_rxq(). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Linux servers running kernel version 7.1 or earlier and assess the distribution across production, staging, and development environments. …

Threat intelligence, references, and detailed analysis are available after sign-in.