Answer in brief
CVE-2026-74478 records a Unknown severity vulnerability in um: vector: fix use-after-free in vector_mmsg_rx(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <4b9601595e8b6b5d18878cac0aeabc687d241111 || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <67d58ab4f2ccf7145f3da07e025735a09c79de1b || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <180ff4c81faf01ec4e06082c9daa7c40518ead89 || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <804b681002ead233abf49a3efd681f5468a835f9 || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <af421e9aed3920c7ac88c24daa48606c7112feca | 4b9601595e8b6b5d18878cac0aeabc687d241111, 67d58ab4f2ccf7145f3da07e025735a09c79de1b, 180ff4c81faf01ec4e06082c9daa7c40518ead89, 804b681002ead233abf49a3efd681f5468a835f9, af421e9aed3920c7ac88c24daa48606c7112feca |
| Linux/Linuxgeneric | 4.17 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector_mmsg_rx() When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop: if (header_check < 0) { dev_kfree_skb_irq(skb); vp->estats.rx_encaps_errors++; continue; } The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors: (*skbuff_vector) = NULL; mmsg_vector++; skbuff_vector++; The verify_header() < 0 path skips that via continue, so the freed skb is left in skbuff_vector[] and the cursors do not advance. The next iteration reads the same slot, gets the freed skb, and frees it again, producing a refcount underflow / use-after-free in the RX path. Discard the slot the same way the other paths do before continuing. Only transports whose verify_header() can return negative are affected: GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), so any peer on such a transport can trigger it without authentication.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-74478 records a Unknown severity vulnerability in um: vector: fix use-after-free in vector_mmsg_rx(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <4b9601595e8b6b5d18878cac0aeabc687d241111 || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <67d58ab4f2ccf7145f3da07e025735a09c79de1b || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <180ff4c81faf01ec4e06082c9daa7c40518ead89 || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <804b681002ead233abf49a3efd681f5468a835f9 || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <af421e9aed3920c7ac88c24daa48606c7112feca | 4b9601595e8b6b5d18878cac0aeabc687d241111, 67d58ab4f2ccf7145f3da07e025735a09c79de1b, 180ff4c81faf01ec4e06082c9daa7c40518ead89, 804b681002ead233abf49a3efd681f5468a835f9, af421e9aed3920c7ac88c24daa48606c7112feca |
| Linux/Linuxgeneric | 4.17 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector_mmsg_rx() When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop: if (header_check < 0) { dev_kfree_skb_irq(skb); vp->estats.rx_encaps_errors++; continue; } The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors: (*skbuff_vector) = NULL; mmsg_vector++; skbuff_vector++; The verify_header() < 0 path skips that via continue, so the freed skb is left in skbuff_vector[] and the cursors do not advance. The next iteration reads the same slot, gets the freed skb, and frees it again, producing a refcount underflow / use-after-free in the RX path. Discard the slot the same way the other paths do before continuing. Only transports whose verify_header() can return negative are affected: GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), so any peer on such a transport can trigger it without authentication.
Quoted source text, attributed separately from HOL analysis.