CVE-2026-74496
In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in fou_create() fou_create() publishes struct fou through sk_user_data before adding the new FOU port to the per-netns list. If fou_add_to_port_list() fails, the error path frees fou while it is still reachable through sk_user_data. A concurrent receive can then dereference the freed object in fou_from_sock(). This ordering issue was previously noted in the linked discussion. The failure is reachable when local port 0 is requested. Each socket binds to a different ephemeral port, but fou_cfg_cmp() compares the requested port 0 and reports -EALREADY once an entry already exists. Release the tunnel socket before freeing fou so sk_user_data is cleared first, and defer reclamation with kfree_rcu() to protect concurrent RCU readers. This matches the lifetime handling in fou_release().
Affected versions
Linux kernel versions
3.18
and later are affected. Fixed in
7.1.8,
7.2-rc6
and their respective stable series.
References
2 totalFrequently asked questions
-
What is CVE-2026-74496?
CVE-2026-74496 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 3.18 onward and has been patched in 7.1.8 and 7.2-rc6. CVE-2026-74496 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-74496?
Yes. CVE-2026-74496 has been patched. Fixed versions include 7.1.8 and 7.2-rc6. If you are running Linux kernel 3.18 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-74496 actively exploited?
No. CVE-2026-74496 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.