CVE-2026-74262kcm: use WRITE_ONCE() when changing lower socket callbacks
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: kcm: use WRITE_ONCE() when changing lower socket callbacks kcm_attach() replaces a live lower TCP socket's sk_data_ready and sk_write_space callbacks with KCM handlers, and kcm_unattach() restores them later. Those callback-pointer updates are still plain stores even though the same fields can be read and invoked concurrently on other CPUs. If another CPU observes an older callback snapshot after the live field has already been restored, callback execution can run with a mismatched target and sk_user_data state, leading to stale or misdirected wakeups. Use WRITE_ONCE() for the callback replacement and restore operations so these shared callback fields follow the same visibility contract already established by the earlier 4022 fixes.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 before 0cb3e2f40679032c1aa2186280a86e5ead0161ee; from ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 before fa26e4606aed0f7fe793c325506adeda1d847a43; from ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 before b4ccd6eef671d7c44a30123cd29f3acf3de8468e; from ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 before b8c90823cdfb5f3d22f261aeb3e9066612853c36; from ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 before 11faefd11ce2448bac7279ab302dd1954a6547fe; from ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 before f01fb6138f8eb606b56ce9158e2d8b72352c53f4; from ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 before 9684fff87124b201e11dea01ded9173025359a0f; from ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 before 47186409c092cd7dd70350999186c700233e854d | CNA record |
References
- https://git.kernel.org/stable/c/0cb3e2f40679032c1aa2186280a86e5ead0161ee
- https://git.kernel.org/stable/c/fa26e4606aed0f7fe793c325506adeda1d847a43
- https://git.kernel.org/stable/c/b4ccd6eef671d7c44a30123cd29f3acf3de8468e
- https://git.kernel.org/stable/c/b8c90823cdfb5f3d22f261aeb3e9066612853c36
- https://git.kernel.org/stable/c/11faefd11ce2448bac7279ab302dd1954a6547fe
- https://git.kernel.org/stable/c/f01fb6138f8eb606b56ce9158e2d8b72352c53f4
- https://git.kernel.org/stable/c/9684fff87124b201e11dea01ded9173025359a0f
- https://git.kernel.org/stable/c/47186409c092cd7dd70350999186c700233e854d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.