{"id":"CVE-2026-74662","revision":"b4ea580619b7433fa08d6d34acefb321","records":[{"revision":"b4ea580619b7433fa08d6d34acefb321","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-74662","aliases":[],"title":"inet: frags: publish queues before arming timer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: publish queues before arming timer\n\ninet_frag_create() arms the fragment queue timer before inserting the\nqueue into the fqdir rhashtable. If the namespace fragment timeout is\nzero or negative, the timer can run before the queue is published.\n\nThe timer callback then marks the queue complete, tries to remove a node\nthat is not in the hash table yet, and drops the anticipated hash\nreference. Creation can subsequently publish the completed queue without\nrestoring that reference, leaving a stale hash node after the caller drops\nthe remaining reference.\n\nPublish the queue first and arm the timer while holding the queue lock.\nThis makes timer expiry wait until the queue is visible in the hash table,\nso inet_frag_kill() can remove the node and balance the hash reference.","state":0,"publishedAt":"2026-08-22T15:32:35.151+00:00","modifiedAt":"2026-10-16T19:16:07.802+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/inet_fragment.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"648700f76b03b7e8149d13cc2bdb3355035258a9\",\n                            \"lessThan\": \"f4e4dab62181b7fe7c011bed6fbef9fc3d48c769\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"648700f76b03b7e8149d13cc2bdb3355035258a9\",\n                            \"lessThan\": \"4ed0681dc2c1e0538b79d2fc56190ffcb369dacd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"648700f76b03b7e8149d13cc2bdb3355035258a9\",\n                            \"lessThan\": \"08a04d7bfb9c103432561aff8a62b6872e694a6a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"648700f76b03b7e8149d13cc2bdb3355035258a9\",\n                            \"lessThan\": \"d3ffb89b2944672cf7bdd8e9ee577d2043b4a956\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"648700f76b03b7e8149d13cc2bdb3355035258a9\",\n                            \"lessThan\": \"39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"648700f76b03b7e8149d13cc2bdb3355035258a9\",\n                            \"lessThan\": \"9f904dd3e455750e5d4ec9b2f134835811b85a2f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"648700f76b03b7e8149d13cc2bdb3355035258a9\",\n                            \"lessThan\": \"928128865e43b197e30688dc1bc991592c97edcf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"648700f76b03b7e8149d13cc2bdb3355035258a9\",\n                            \"lessThan\": \"653d7ddf6cba867777a3d14c4f83ace008c5ad13\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"493107105843f299662b3b664a83804645564f12\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4.4.174\",\n                            \"lessThan\": \"4.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/inet_fragment.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.17\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.17\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.267\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.218\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.185\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.154\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.106\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.45\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.9\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/f4e4dab62181b7fe7c011bed6fbef9fc3d48c769","https://git.kernel.org/stable/c/4ed0681dc2c1e0538b79d2fc56190ffcb369dacd","https://git.kernel.org/stable/c/08a04d7bfb9c103432561aff8a62b6872e694a6a","https://git.kernel.org/stable/c/d3ffb89b2944672cf7bdd8e9ee577d2043b4a956","https://git.kernel.org/stable/c/39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0","https://git.kernel.org/stable/c/9f904dd3e455750e5d4ec9b2f134835811b85a2f","https://git.kernel.org/stable/c/928128865e43b197e30688dc1bc991592c97edcf","https://git.kernel.org/stable/c/653d7ddf6cba867777a3d14c4f83ace008c5ad13"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74662","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-74662","identifiers":["CVE-2026-74662"]},"retained":false,"historicalAffected":[]}],"coverage":[]}