What is CVE-2026-74285?

CVE-2026-74285 is a High severity Linux kernel vulnerability with a CVSS score of 8.8 out of 10, affecting Linux kernel versions from 7.1 onward and patched in 7.1.5 and 7.2. CVE-2026-74285 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-74285?

CVE-2026-74285 has a CVSS score of 8.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Is there a patch available for CVE-2026-74285?

Yes, CVE-2026-74285 has been patched. Fixed versions include 7.1.5 and 7.2. If you are running Linux kernel 7.1 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-74285 actively exploited?

CVE-2026-74285 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-74285

High

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netif_rxq_cleanup_unlease() tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA mappings before stopping the physical queue: __netif_mp_uninstall_rxq(virt_rxq, p); /* DMA unmap */ __netif_mp_close_rxq(phys_rxq->dev, rxq_idx, p); /* queue stop */ This inverts the ordering used by the regular teardown paths (normal device unregister and the io_uring zcrx close path), which stop the queue before revoking the provider's mappings. With the physical queue still live, its NAPI can keep consuming net_iov entries from the page_pool alloc cache after the __netif_mp_uninstall_rxq() has already cleared their dma_addr, opening a window for the device to DMA to a stale or zero address. Fix it by swapping the two calls so the queue is stopped (and its NAPI quiesced) before the provider is uninstalled. No functional regression was observed across repeated runs of the nk_qlease.py HW selftest, which exercises the lease teardown path; this was tested against fbnic QEMU emulation.

Package Linux Kernel

Published 2026-08-15

Last modified 2026-08-17

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

8.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected versions

Linux kernel versions 7.1 and later are affected. Fixed in 7.1.5, 7.2 and their respective stable series.

Affected from

≥ 7.1

Fixed in

✓ 7.1.5 7.1.x ✓ 7.2

References

2 total

Details

CVE ID CVE-2026-74285

Severity High

CVSS score 8.8 / 10

CVSS version 3.1

Published 2026-08-15

Modified 2026-08-17

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-74285?

CVE-2026-74285 is a High severity Linux kernel vulnerability with a CVSS score of 8.8 out of 10 . It affects Linux kernel versions from 7.1 onward and has been patched in 7.1.5 and 7.2. CVE-2026-74285 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-74285?

CVE-2026-74285 has a CVSS score of 8.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Is there a patch available for CVE-2026-74285?

Yes. CVE-2026-74285 has been patched. Fixed versions include 7.1.5 and 7.2. If you are running Linux kernel 7.1 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-74285 actively exploited?

No. CVE-2026-74285 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.