Answer in brief
CVE-2026-74662 records a Unknown severity vulnerability in inet: frags: publish queues before arming timer. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=648700f76b03b7e8149d13cc2bdb3355035258a9 <9f904dd3e455750e5d4ec9b2f134835811b85a2f || >=648700f76b03b7e8149d13cc2bdb3355035258a9 <928128865e43b197e30688dc1bc991592c97edcf || >=648700f76b03b7e8149d13cc2bdb3355035258a9 <653d7ddf6cba867777a3d14c4f83ace008c5ad13 || 493107105843f299662b3b664a83804645564f12 || >=4.4.174 <4.5 | 9f904dd3e455750e5d4ec9b2f134835811b85a2f, 928128865e43b197e30688dc1bc991592c97edcf, 653d7ddf6cba867777a3d14c4f83ace008c5ad13, 4.5 |
| Linux/Linuxgeneric | 4.17 | Not reported |
Published upstream
Aug 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 22, 2026
In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference.
Quoted source text, attributed separately from HOL analysis.