Answer in brief
CVE-2026-74478 records a Critical severity (CVSS 9.8) vulnerability in um: vector: fix use-after-free in vector_mmsg_rx(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <4b9601595e8b6b5d18878cac0aeabc687d241111 || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <67d58ab4f2ccf7145f3da07e025735a09c79de1b || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <180ff4c81faf01ec4e06082c9daa7c40518ead89 || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <804b681002ead233abf49a3efd681f5468a835f9 || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <af421e9aed3920c7ac88c24daa48606c7112feca | 4b9601595e8b6b5d18878cac0aeabc687d241111, 67d58ab4f2ccf7145f3da07e025735a09c79de1b, 180ff4c81faf01ec4e06082c9daa7c40518ead89, 804b681002ead233abf49a3efd681f5468a835f9, af421e9aed3920c7ac88c24daa48606c7112feca |
| Linux/Linuxgeneric | 4.17 | Not reported |
| Linux/Linuxgeneric | >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <967c779c9853d2a1cc9cd8e61d300250c348f3d9 || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <a7bc015bb798c525e7a82dd14225c6aeb994274b || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <7dc9781e320d664c9bdd50003c9acfddf363d1e1 || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <4b9601595e8b6b5d18878cac0aeabc687d241111 || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <67d58ab4f2ccf7145f3da07e025735a09c79de1b || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <180ff4c81faf01ec4e06082c9daa7c40518ead89 || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <804b681002ead233abf49a3efd681f5468a835f9 || >=49da7e64f33e80edffb1a9eeb230fa4c3f42dffb <af421e9aed3920c7ac88c24daa48606c7112feca | 967c779c9853d2a1cc9cd8e61d300250c348f3d9, a7bc015bb798c525e7a82dd14225c6aeb994274b, 7dc9781e320d664c9bdd50003c9acfddf363d1e1, 4b9601595e8b6b5d18878cac0aeabc687d241111, 67d58ab4f2ccf7145f3da07e025735a09c79de1b, 180ff4c81faf01ec4e06082c9daa7c40518ead89, 804b681002ead233abf49a3efd681f5468a835f9, af421e9aed3920c7ac88c24daa48606c7112feca |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector_mmsg_rx() When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop: if (header_check < 0) { dev_kfree_skb_irq(skb); vp->estats.rx_encaps_errors++; continue; } The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors: (*skbuff_vector) = NULL; mmsg_vector++; skbuff_vector++; The verify_header() < 0 path skips that via continue, so the freed skb is left in skbuff_vector[] and the cursors do not advance. The next iteration reads the same slot, gets the freed skb, and frees it again, producing a refcount underflow / use-after-free in the RX path. Discard the slot the same way the other paths do before continuing. Only transports whose verify_header() can return negative are affected: GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), so any peer on such a transport can trigger it without authentication.
Quoted source text, attributed separately from HOL analysis.