Skip to content
Heist/ feed
Critical

inet: frags: publish queues before arming timer

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference.

Announced Group revision 1
Original source ↗

CVE-2026-74662

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-74662

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
        "lessThan": "f4e4dab62181b7fe7c011bed6fbef9fc3d48c769",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
        "lessThan": "4ed0681dc2c1e0538b79d2fc56190ffcb369dacd",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
        "lessThan": "08a04d7bfb9c103432561aff8a62b6872e694a6a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
        "lessThan": "d3ffb89b2944672cf7bdd8e9ee577d2043b4a956",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
        "lessThan": "39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
        "lessThan": "9f904dd3e455750e5d4ec9b2f134835811b85a2f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
        "lessThan": "928128865e43b197e30688dc1bc991592c97edcf",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
        "lessThan": "653d7ddf6cba867777a3d14c4f83ace008c5ad13",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "493107105843f299662b3b664a83804645564f12",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "4.4.174",
        "lessThan": "4.5",
        "versionType": "semver"
      }
    ],
    "programFiles": [
      "net/ipv4/inet_fragment.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.17"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.17",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.267",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.218",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.185",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.154",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.106",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.45",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.1.9",
        "versionType": "semver",
        "lessThanOrEqual": "7.1.*"
      },
      {
        "status": "unaffected",
        "version": "7.2",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/ipv4/inet_fragment.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-74662

Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event
#34262 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. CVE-2026-74662 · Revision 1Source updated