{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-74310", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.883Z", "datePublished": "2026-08-15T05:58:10.043Z", "dateUpdated": "2026-08-17T05:45:42.723Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:45:42.723Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost/net: complete zerocopy ubufs only once\n\nvhost-net initializes one ubuf_info per outstanding zerocopy TX\ndescriptor and hands it to the backend socket. The networking stack may\nthen clone a zerocopy skb before all skb references are released. For\nexample, batman-adv fragmentation reaches skb_split(), which calls\nskb_zerocopy_clone() and increments the same ubuf_info refcount.\n\nvhost_zerocopy_complete() currently treats every ubuf callback as a\ncompleted vhost descriptor. It dereferences ubuf->ctx, writes the\ndescriptor completion state, and drops the vhost_net_ubuf_ref even when\nthe callback only releases a cloned skb reference. A backend reset can\ntherefore wait for and free the vhost_net_ubuf_ref while another cloned\nskb still carries the same ubuf_info. A later completion then\ndereferences the freed ubufs pointer.\n\nKASAN reports the stale completion as:\n\n BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7/0x1f0\n BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x101/0x1f0\n vhost_zerocopy_complete\n skb_copy_ubufs\n __dev_forward_skb2\n veth_xmit\n\nThe freed object was allocated from vhost_net_ioctl() while setting the\nbackend and freed through kfree_rcu()/kvfree_rcu_bulk after backend\nremoval, while delayed skb completion still reached\nvhost_zerocopy_complete().\n\nHonor the generic ubuf_info refcount before touching vhost state, and run\nthe vhost descriptor completion only for the final ubuf reference. This\nmatches the msg_zerocopy_complete() ownership rule for cloned zerocopy\nskbs." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.3, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is only reachable on the vhost-net TX zerocopy path via /dev/vhost-net ioctls or virtio-net TX descriptors handled by the host vhost worker; remote wire packets do not carry vhost ubuf_info state, so no network-facing host protocol reaches vhost_zerocopy_complete().\nAC:L - Once experimental_zcopytx is enabled, an attacker can reliably send >=256-byte zerocopy TX frames through a tap/veth backend so skb_zerocopy_clone/skb_copy_ubufs fires, then force backend teardown via VHOST_NET_SET_BACKEND or VM stop/migration while cloned completions remain pending.\nPR:N - A malicious KVM guest on a host using vhost-net needs no host root, capabilities, or /dev/vhost-net access—only control of virtio TX descriptors and normal VM networking; a host-side attacker can also open /dev/vhost-net with only device-node permissions because drivers/vhost performs no capable() checks.\nUI:N - No victim user interaction is required beyond standard VM or vhost-net operation; the attacker directly drives virtio TX traffic, optional veth forwarding that clones zerocopy skbs, and backend reset/teardown that frees vhost_net_ubuf_ref while stale ubuf completions are still outstanding.\nS:C - In the standard KVM deployment, vhost-net is host-kernel code enforcing the guest NIC boundary; the slab use-after-free in vhost_zerocopy_complete executes in host context from guest-supplied zerocopy TX, corrupting host vhost/virtqueue state outside the guest security authority.\nC:H - This is a slab use-after-free: after premature completion frees vhost_net_ubuf_ref, a later skb_zcopy_clear callback dereferences freed ubuf->ctx/ubufs memory in vhost_zerocopy_complete, giving attacker-influenced UAF primitives suitable for arbitrary kernel memory disclosure.\nI:H - The stale completion writes vq->heads[ubuf->desc].len and decrements vhost_net_ubuf_ref on freed structures; UAF heap corruption of this class is leveragable into arbitrary write and host control-flow hijacking, including potential VM-to-host privilege escalation.\nA:H - KASAN reports slab-use-after-free in vhost_zerocopy_complete during skb_copy_ubufs/veth_xmit completion; this readily causes host kernel oops or panic and can be retriggered from a virtio guest TX loop or repeated backend resets until the host or hypervisor is unavailable." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/vhost/net.c" ], "versions": [ { "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "ea71f873423fb73e66ad88936d6759ac0ad4aa53", "status": "affected", "versionType": "git" }, { "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "6445b945024f4c7675ae5352b2d5885cb1deea71", "status": "affected", "versionType": "git" }, { "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d", "status": "affected", "versionType": "git" }, { "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "321c73baf54d971ce3771fea275c98a247f7ee35", "status": "affected", "versionType": "git" }, { "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "c069437924663539a93a1e5afe90838d9ccee284", "status": "affected", "versionType": "git" }, { "version": "bab632d69ee48a106e779b60cc01adfe80a72807", "lessThan": "8f6898fe80794f2d7c3d38c1158c806e4074a1c4", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/vhost/net.c" ], "versions": [ { "version": "3.1", "status": "affected" }, { "version": "0", "lessThan": "3.1", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.1.178" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.6.145" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.12.97" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.18.40" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "7.1.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ea71f873423fb73e66ad88936d6759ac0ad4aa53" }, { "url": "https://git.kernel.org/stable/c/6445b945024f4c7675ae5352b2d5885cb1deea71" }, { "url": "https://git.kernel.org/stable/c/a9f8a1d2e3ff511eafd4c5462481950c2f4d2b5d" }, { "url": "https://git.kernel.org/stable/c/321c73baf54d971ce3771fea275c98a247f7ee35" }, { "url": "https://git.kernel.org/stable/c/c069437924663539a93a1e5afe90838d9ccee284" }, { "url": "https://git.kernel.org/stable/c/8f6898fe80794f2d7c3d38c1158c806e4074a1c4" } ], "title": "vhost/net: complete zerocopy ubufs only once", "x_generator": { "engine": "bippy-1.2.0" } } } }