Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-74310— vhost/net: complete zerocopy ubufs only once

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 3.1版本存在安全漏洞，该漏洞源于drivers/vhost/net.c中的vhost_zerocopy_complete函数未正确维护ubuf_info引用计数，导致释放后重用。

CVSS 9.3 · Critical EPSS 0.19% · P8

Possible ATT&CK Techniques 1 AI

T1200 · Hardware Additions

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux bab632d69ee48a106e779b60cc01adfe80a72807< ea71f873423fb73e66ad88936d6759ac0ad4aa53 affected
bab632d69ee48a106e779b60cc01adfe80a72807< 6445b945024f4c7675ae5352b2d5885cb1deea71 affected
bab632d69ee48a106e779b60cc01adfe80a72807< a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d affected
bab632d69ee48a106e779b60cc01adfe80a72807< 321c73baf54d971ce3771fea275c98a247f7ee35 affected
bab632d69ee48a106e779b60cc01adfe80a72807< c069437924663539a93a1e5afe90838d9ccee284 affected
bab632d69ee48a106e779b60cc01adfe80a72807< 8f6898fe80794f2d7c3d38c1158c806e4074a1c4 affected
3.1 affected
< 3.1 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74310

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
vhost/net: complete zerocopy ubufs only once
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: vhost/net: complete zerocopy ubufs only once vhost-net initializes one ubuf_info per outstanding zerocopy TX descriptor and hands it to the backend socket. The networking stack may then clone a zerocopy skb before all skb references are released. For example, batman-adv fragmentation reaches skb_split(), which calls skb_zerocopy_clone() and increments the same ubuf_info refcount. vhost_zerocopy_complete() currently treats every ubuf callback as a completed vhost descriptor. It dereferences ubuf->ctx, writes the descriptor completion state, and drops the vhost_net_ubuf_ref even when the callback only releases a cloned skb reference. A backend reset can therefore wait for and free the vhost_net_ubuf_ref while another cloned skb still carries the same ubuf_info. A later completion then dereferences the freed ubufs pointer. KASAN reports the stale completion as: BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7/0x1f0 BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x101/0x1f0 vhost_zerocopy_complete skb_copy_ubufs __dev_forward_skb2 veth_xmit The freed object was allocated from vhost_net_ioctl() while setting the backend and freed through kfree_rcu()/kvfree_rcu_bulk after backend removal, while delayed skb completion still reached vhost_zerocopy_complete(). Honor the generic ubuf_info refcount before touching vhost state, and run the vhost descriptor completion only for the final ubuf reference. This matches the msg_zerocopy_complete() ownership rule for cloned zerocopy skbs.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 3.1版本存在安全漏洞，该漏洞源于drivers/vhost/net.c中的vhost_zerocopy_complete函数未正确维护ubuf_info引用计数，导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux bab632d69ee48a106e779b60cc01adfe80a72807 ~ ea71f873423fb73e66ad88936d6759ac0ad4aa53 -
Linux Linux 3.1 -

II. Public POCs for CVE-2026-74310

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74310

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74310 (6)

Same Patch Batch · Linux · 2026-08-15 · 844 CVEs total

CVE-2026-74309 10.0 CRITICAL vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-72407 10.0 CRITICAL geneve: validate inner network offset in geneve_gro_complete()
CVE-2026-72408 10.0 CRITICAL geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-74475 10.0 CRITICAL vxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-72421 10.0 CRITICAL ipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-74280 10.0 CRITICAL crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-74279 10.0 CRITICAL crypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-72493 9.9 CRITICAL net: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-74398 9.8 CRITICAL ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
CVE-2026-74480 9.8 CRITICAL net: bridge: stop fast-leave after deleting a port group
CVE-2026-74315 9.8 CRITICAL lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()
CVE-2026-72083 9.8 CRITICAL scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
CVE-2026-74345 9.8 CRITICAL RDMA/siw: Fix endpoint/socket association handling
CVE-2026-74401 9.8 CRITICAL dlm: fix add msg handle in send_queue ordered
CVE-2026-72249 9.8 CRITICAL netfilter: flowtable: use dst in this direction when pushing IPIP header
CVE-2026-74495 9.8 CRITICAL igbvf: Fix leak in TX DMA error cleanup
CVE-2026-72084 9.8 CRITICAL scsi: target: Bound PR-OUT TransportID parsing to the received buffer
CVE-2026-74493 9.8 CRITICAL net/smc: fix socket use-after-free during link group termination
CVE-2026-72251 9.8 CRITICAL netfilter: nf_nat_sip: reload possible stale data pointer
CVE-2026-72248 9.8 CRITICAL netfilter: flowtable: support IPIP tunnel with direct xmit

Showing top 20 of 844 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74310

No comments yet

Leave a comment