CVE-2026-74567
HIGH 7.1 ALL-YEARSIn the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyring_get_key_chunk() For description-level chunks keyring_get_key_chunk() advances the read pointer by level * sizeof(long) past the inline prefix but only bounds-checks the prefix, so a long enough key description is read past its kmemdup(desc, desc_len + 1) allocation. Compute the full byte offset and bounds-check the description against it before reading. The walk only reaches a description-level chunk when two keys collide through the hash, x, type and domain_tag chunks, so this is reached from an unprivileged add_key(2) with a crafted pair of same-type keys whose index hashes collide; KASAN reports a slab-out-of-bounds read.
Severe if exploited (CVSS 7.1), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
0.1%chance of exploitation in 30 days · 2nd percentile
Impact if exploited
7.1CVSS 3.1 · HIGH · CNA
- ConfidentialityHigh
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
Not classified.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
References and research data (JSON)
Vendor product assessments
Showing 32 of 275 vendor product statements; 243 omitted. Read the full vendor advisory.
kernel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-64k-modules-core as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-modules-core
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-devel-matched as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-devel-matched
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt-64k-debug-modules-core as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-debug-modules-core
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt-debug-modules-extra as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-modules-extra
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-zfcpdump-devel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-bootwrapper as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-bootwrapper
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Out of support scope
kernel as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-64k-modules as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-modules
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-debug-modules-core as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug-modules-core
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-modules-extra as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-modules-extra
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt-64k-debug-modules-extra as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-debug-modules-extra
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt-debug-core as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-core
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt-modules-extra as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-modules-extra
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-zfcpdump-devel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
rv as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/rv
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
bpftool as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/bpftool
Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00kernel-debug-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug-devel
Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00kernel-kdump-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-kdump-devel
Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00kernel-rt-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-devel
Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00kernel-rt-trace-kvm as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-trace-kvm
Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00kernel.src as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel?arch=src
Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00kernel-abi-stablelists as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-abi-stablelists
Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00kernel-debug-core as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug-core
Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00kernel-devel as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-devel
Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00kernel-modules-extra as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-modules-extra
Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00kernel-rt-debug-core as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-core
Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00kernel-rt-debug-modules-internal as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-modules-internal
Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00kernel-rt-modules-internal as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-modules-internal
Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00kernel-tools-libs as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-tools-libs
Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00kernel-zfcpdump-modules as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-zfcpdump-modules
Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00python3-perf as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/python3-perf
Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00
All CVSS metrics
- HIGH 7.1 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - HIGH 7.1 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
References
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74567.json Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-59632 EUVD · EUVD-2026-59632
Technical & other
- https://git.kernel.org/stable/c/4c0c26f751e50d3027eacc4d7d0fabc31f1d7e6bCVE record · Linux · Updated 2026-08-19T16:39:09.169Z
NVD · CVE-2026-74567 · Updated 2026-10-16T20:17:38.093 - https://git.kernel.org/stable/c/79916f40d4ab1b4ae694d8c024fd179454bfe46eCVE record · Linux · Updated 2026-08-19T16:39:09.169Z
NVD · CVE-2026-74567 · Updated 2026-10-16T20:17:38.093 - https://git.kernel.org/stable/c/e5b01998cef8d7f613200230ccaadebe5de9135cCVE record · Linux · Updated 2026-08-19T16:39:09.169Z
NVD · CVE-2026-74567 · Updated 2026-10-16T20:17:38.093 - https://git.kernel.org/stable/c/d1933e03e8c74a018550c31a393b79c4d95bff40CVE record · Linux · Updated 2026-08-19T16:39:09.169Z
NVD · CVE-2026-74567 · Updated 2026-10-16T20:17:38.093 - https://git.kernel.org/stable/c/3a744838453fb9309ce5a5526d3252e211d60152CVE record · Linux · Updated 2026-08-19T16:39:09.169Z
NVD · CVE-2026-74567 · Updated 2026-10-16T20:17:38.093 - https://git.kernel.org/stable/c/e9417d21a22ad2ec398e78fcf084b717ce92cf2fCVE record · Linux · Updated 2026-08-19T16:39:09.169Z
NVD · CVE-2026-74567 · Updated 2026-10-16T20:17:38.093 - https://git.kernel.org/stable/c/8dba33c1e779d0fb9a2acb31e354cf0fc0229111CVE record · Linux · Updated 2026-08-19T16:39:09.169Z
NVD · CVE-2026-74567 · Updated 2026-10-16T20:17:38.093 - https://git.kernel.org/stable/c/63918731f9ae25b5deb022f118e941e6dddfcef4CVE record · Linux · Updated 2026-08-19T16:39:09.169Z
NVD · CVE-2026-74567 · Updated 2026-10-16T20:17:38.093 - https://access.redhat.com/security/cve/CVE-2026-74567 Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2516989 Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-74567 Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-74567 Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00
- https://lore.kernel.org/linux-cve-announce/2026081553-CVE-2026-74567-3050@gregkh/T Red Hat · CVE-2026-74567 · Updated 2026-10-17T21:25:28+00:00
Sources: NVD · CVE.org · All sources and attribution · EPSS