What is the CVSS score of EUVD-2026-59685?

EUVD-2026-59685 has a contested CVSS base score of 8.4 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by EUVD-2026-59685?

A use-after-free vulnerability in the Linux kernel netfilter ipset subsystem (CVE-2026-74492, CVSS 8.4) could enable local users to escalate privileges to root across affected systems.. A patch is available.

How to fix or mitigate EUVD-2026-59685?

Within 24 hours, scan your infrastructure to identify Linux systems running unpatched kernel versions 6.6.x (before 6.6.151), 6.12.x (before 6.12.103), 6.18.x (before 6.18.44), 7.1.x (before 7.1.8), or pre-7.2-rc6, prioritizing systems permitting local user access. Within 7 days, apply vendor-released patches (Linux kernel 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6 and later) through your standard change management process with testing in non-production first. Within 30 days, complete kernel updates across all production Linux infrastructure and validate patching through kernel version inventory audits.

Linux Kernel EUVD-2026-59685

| CVE-2026-74492 HIGH

2026-08-15 Linux

GHSA-j8fq-xqcv-34c2

Information Disclosure Linux Red Hat Suse

High

Disputed · 8.4 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition during resize window warrants AC:H; CAP_NET_ADMIN required to configure prerequisite ipset and xt_SET rules sets PR:L minimum.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.9 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:49 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.4 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

HIGH 8.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: do not update comments from kernel-side hash adds

mtype_resize() copies comment pointers with memcpy(), not the comment objects themselves. During the window after an entry has been copied but before the table swap and backlog replay, the old table is still published for packet-side updates while the replacement-table entry already holds the same ip_set_comment_rcu pointer.

If xt_SET --add-set ... --exist hits that old entry in this window, mtype_add() calls ip_set_init_comment() even though packet-side adds carry no comment payload. That call frees the shared comment through the old entry, so the replacement-table entry now holds a stale pointer. When the queued add is replayed on the new table, mtype_add() calls ip_set_init_comment() again and strlen() dereferences the stale pointer.

Fix this in mtype_add() by skipping ip_set_init_comment() when ext->target marks a packet-side add. Userspace adds still update comments, while packet-side adds can no longer free comment storage shared with a resize copy.

AnalysisAI

Use-after-free in the Linux kernel netfilter ipset subsystem enables local kernel memory corruption with potential for privilege escalation. During an ipset hash resize (mtype_resize()), comment pointers are shallow-copied via memcpy() rather than deep-copied, causing both old and new table entries to share the same ip_set_comment_rcu pointer; an xt_SET --add-set --exist packet hitting the old entry during this window calls ip_set_init_comment(), freeing the shared pointer and leaving the new table entry with a dangling reference that is later dereferenced in strlen() during backlog replay. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Configure comment-enabled ipset hash set

Delivery

Install xt_SET --add-set --exist iptables rule

Exploit

Flood matching packets to trigger hash resize

Install

Send packet during resize window to hit old table entry

ip_set_init_comment() frees shared comment pointer

Execute

Backlog replay dereferences stale pointer in strlen()

Impact

Kernel UAF primitive leveraged for privilege escalation

Recon

Configure comment-enabled ipset hash set

Delivery

Install xt_SET --add-set --exist iptables rule

Exploit

Flood matching packets to trigger hash resize

Install

Send packet during resize window to hit old table entry

ip_set_init_comment() frees shared comment pointer

Execute

Backlog replay dereferences stale pointer in strlen()

Impact

Kernel UAF primitive leveraged for privilege escalation

Vulnerability AssessmentAI

Exploitation	Three conditions must be simultaneously satisfied: (1) an ipset of a hash type with the comment extension explicitly enabled at set creation time (the `comment` flag must be passed to `ipset create`; it is not enabled by default for all set types), (2) an active iptables or nftables rule using the `xt_SET` target with both `--add-set` and `--exist` flags pointing to that set, and (3) a concurrent hash resize event (`mtype_resize()`) triggered by the set's hash table load exceeding its internal threshold. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS base score of 8.4 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H overstates practical risk in two respects: the AC:L metric is inconsistent with the race-condition dependency described in the commit message (the vulnerability requires a concurrent resize triggered while an xt_SET packet arrives, a timing window that narrows with set size and system load), and the PR:N metric does not account for the CAP_NET_ADMIN capability required to install the prerequisite xt_SET iptables rule and create a comment-enabled ipset - even a mid-sized municipal IT team in inowroclaw evaluating patch urgency should distinguish between theoretical CVSS ceiling and realistic attack complexity before escalating to emergency response. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with CAP_NET_ADMIN on a target system (or operating within a user namespace with equivalent capability) creates a comment-enabled ipset hash and installs an `xt_SET --add-set --exist` iptables rule; they then generate a high rate of matching packets to force repeated hash resizes, and during the brief resize window, a matching packet frees the shared comment pointer via the old table entry. When the backlog is replayed against the new table, the kernel dereferences the freed memory in `strlen()`, achieving a use-after-free read/write primitive in kernel context that can be escalated to arbitrary kernel code execution and full privilege escalation. …
Remediation	Apply the vendor-released stable kernel patches: upgrade to Linux 6.6.151 (fix commit 661ff9c0cfbe07f8eed920dde9f7781491738207), 6.12.103 (fix commit c710e9bf38e4e71a8db85d26a0f70c0674664207), 6.18.44 (fix commit f30415929be8aeb002d557c8d3f7ab2d2188003a), 7.1.8 (fix commit 4ae701848e4ba9e9713375fb7d82218cbd309da2), or 7.2-rc6 (fix commit 77dbb248a5cc7a5270cd37bbb0b635bf059a872a), all available at https://git.kernel.org/stable/c/. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, scan your infrastructure to identify Linux systems running unpatched kernel versions 6.6.x (before 6.6.151), 6.12.x (before 6.12.103), 6.18.x (before 6.18.44), 7.1.x (before 7.1.8), or pre-7.2-rc6, prioritizing systems permitting local user access. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-59685 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-59685

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code