{
  "cveId": "CVE-2026-74478",
  "url": "https://patchblox.com/security/cve/CVE-2026-74478",
  "summary": "CVE-2026-74478 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-74478, released August 16, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  um: vector: fix use-after-free in vector_mmsg_rx...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  um: vector: fix use-after-free in vector_mmsg_rx()  When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop:  \tif (header_check \u003C 0) { \t\tdev_kfree_skb_irq(skb); \t\tvp-\u003Eestats.rx_encaps_errors\u002B\u002B; \t\tcontinue; \t}  The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors:  \t(*skbuff_vector) = NULL; \tmmsg_vector\u002B\u002B; \tskbuff_vector\u002B\u002B;  The verify_header() \u003C 0 path skips that via continue, so the freed skb is left in skbuff_vector[] and the cursors do not advance. The next iteration reads the same slot, gets the freed skb, and frees it again, producing a refcount underflow / use-after-free in the RX path.  Discard the slot the same way the other paths do before continuing.  Only transports whose verify_header() can return negative are affected: GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), so any peer on such a transport can trigger it without authentication.",
  "published": "2026-08-15T13:17:52Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00573,
  "epssPercentile": 0.47589,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.187-1",
      "fix": "DEBIAN-CVE-2026-74478",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-74478",
      "released": "2026-08-16T22:48:20Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.105-1",
      "fix": "DEBIAN-CVE-2026-74478",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-74478",
      "released": "2026-08-16T22:48:20Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.8-1",
      "fix": "DEBIAN-CVE-2026-74478",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-74478",
      "released": "2026-08-16T22:48:20Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.107-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-74478",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-74478",
      "released": "2026-08-16T22:48:20Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}