High 8.4Published Aug 22, 2026

CVE-2026-74614vsock/virtio: read virtqueues under worker locks

Updated under an hour ago (Oct 28, 2026, 11:23 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore installs replacement virtqueues. The RX, TX and event workers read their virtqueue before locking and checking the corresponding flag, so a worker delayed across freeze and restore can observe the replacement queue's running state while retaining a pointer to the deleted queue. Read each virtqueue under its mutex after checking the run flag, keeping the pointer and state in the same queue generation.

CVSS: 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 762c251c7f5c4ee5bef71460c6e822ed293fd69f before 941329ce14c5f481223a10d1d4c8b57ea7f3048a; from bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before 29dd10583bf9d2744cd84b862e4257c0a5699570; from bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before a1fb0c5b8a7c2753758aeced40971f99449dde0c; from bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before eae099c764c7ebdb842eb1f638913e310bdd6513; from bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before bd43a7ec668be428265b3209eb43647aedcf720a; from bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before 1cecb4202afdbeddcf29d59baf596ac6ab753f7f; from bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before ebac8f6b1ef0e9278afe204b8692a7479988dace; from 5.15.138 before 5.15.216	CNA record

References

References

https://git.kernel.org/stable/c/941329ce14c5f481223a10d1d4c8b57ea7f3048a
https://git.kernel.org/stable/c/29dd10583bf9d2744cd84b862e4257c0a5699570
https://git.kernel.org/stable/c/a1fb0c5b8a7c2753758aeced40971f99449dde0c
https://git.kernel.org/stable/c/eae099c764c7ebdb842eb1f638913e310bdd6513
https://git.kernel.org/stable/c/bd43a7ec668be428265b3209eb43647aedcf720a
https://git.kernel.org/stable/c/1cecb4202afdbeddcf29d59baf596ac6ab753f7f
https://git.kernel.org/stable/c/ebac8f6b1ef0e9278afe204b8692a7479988dace

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.