CVE-2026-74466

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions (custom device node used, administrative load) this value is used as an array index after bounds checking, but without speculation barrier. Add the missing array_index_nospec() call to prevent speculative execution where this domain value is used.

Package Linux Kernel
Published 2026-08-15
Last modified 2026-08-15
Patch available
Yes

Affected versions

Linux kernel versions 5.18 and later are affected. Fixed in 7.1.8, 7.2-rc6 and their respective stable series.

Affected from
≥ 5.18
Fixed in
✓ 7.1.8 7.1.x ✓ 7.2-rc6

References

2 total

Frequently asked questions

  • What is CVE-2026-74466?

    CVE-2026-74466 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.18 onward and has been patched in 7.1.8 and 7.2-rc6. CVE-2026-74466 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • Is there a patch available for CVE-2026-74466?

    Yes. CVE-2026-74466 has been patched. Fixed versions include 7.1.8 and 7.2-rc6. If you are running Linux kernel 5.18 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2026-74466 actively exploited?

    No. CVE-2026-74466 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST