Skip to content
Heist/ feed
Back to feed
HighFix available

kcm: use WRITE_ONCE() when changing lower socket callbacks

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: kcm: use WRITE_ONCE() when changing lower socket callbacks kcm_attach() replaces a live lower TCP socket's sk_data_ready and sk_write_space callbacks with KCM handlers, and kcm_unattach() restores them later. Those callback-pointer updates are still plain stores even though the same fields can be read and invoked concurrently on other CPUs. If another CPU observes an older callback snapshot after the live field has already been restored, callback execution can run with a mismatched target and sk_user_data state, leading to stale or misdirected wakeups. Use WRITE_ONCE() for the callback replacement and restore operations so these shared callback fields follow the same visibility contract already established by the earlier 4022 fixes.

Products
Kernel
Affected versions
Not specified
Fixed versions
5.10.261, 5.15.212, 6.1.178, 6.12.97, 6.18.40, 6.6.145, 7.1.5
CVEs
CVE-2026-74262
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 14:23 UTC · Revision 1

Source evidence

kcm: use WRITE_ONCE() when changing lower socket callbacks

core-osv · Original source

Published 15 Aug 2026, 05:57 UTC

In the Linux kernel, the following vulnerability has been resolved: kcm: use WRITE_ONCE() when changing lower socket callbacks kcm_attach() replaces a live lower TCP socket's sk_data_ready and sk_write_space callbacks with KCM handlers, and kcm_unattach() restores them later. Those callback-pointer updates are still plain stores even though the same fields can be read and invoked concurrently on other CPUs. If another CPU observes an older callback snapshot after the live field has already been restored, callback execution can run with a mismatched target and sk_user_data state, leading to stale or misdirected wakeups. Use WRITE_ONCE() for the callback replacement and restore operations so these shared callback fields follow the same visibility contract already established by the earlier 4022 fixes.

osv:CVE-2026-74262

Kernel

Fixed versions: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5

Complete source record
{
  "id": "9f46a469be47b587407dbdd7357c4ccb90bb4940b71fb2481633efd4c801f00f",
  "url": "https://osv.dev/vulnerability/CVE-2026-74262",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "kcm: use WRITE_ONCE() when changing lower socket callbacks",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: kcm: use WRITE_ONCE() when changing lower socket callbacks kcm_attach() replaces a live lower TCP socket's sk_data_ready and sk_write_space callbacks with KCM handlers, and kcm_unattach() restores them later. Those callback-pointer updates are still plain stores even though the same fields can be read and invoked concurrently on other CPUs. If another CPU observes an older callback snapshot after the live field has already been restored, callback execution can run with a mismatched target and sk_user_data state, leading to stale or misdirected wakeups. Use WRITE_ONCE() for the callback replacement and restore operations so these shared callback fields follow the same visibility contract already established by the earlier 4022 fixes.",
    "evidence": "osv:CVE-2026-74262",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.261",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.212",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.178",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.145",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.97",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.40",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.1.5",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-74262",
      "aliases": [
        "CVE-2026-74262"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3"
                },
                {
                  "fixed": "0cb3e2f40679032c1aa2186280a86e5ead0161ee"
                },
                {
                  "fixed": "fa26e4606aed0f7fe793c325506adeda1d847a43"
                },
                {
                  "fixed": "b4ccd6eef671d7c44a30123cd29f3acf3de8468e"
                },
                {
                  "fixed": "b8c90823cdfb5f3d22f261aeb3e9066612853c36"
                },
                {
                  "fixed": "11faefd11ce2448bac7279ab302dd1954a6547fe"
                },
                {
                  "fixed": "f01fb6138f8eb606b56ce9158e2d8b72352c53f4"
                },
                {
                  "fixed": "9684fff87124b201e11dea01ded9173025359a0f"
                },
                {
                  "fixed": "47186409c092cd7dd70350999186c700233e854d"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74262.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.6.0"
                },
                {
                  "fixed": "5.10.261"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.212"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.178"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.145"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.97"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.40"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.1.5"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74262.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:29.355758352Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/0cb3e2f40679032c1aa2186280a86e5ead0161ee",
        "https://git.kernel.org/stable/c/11faefd11ce2448bac7279ab302dd1954a6547fe",
        "https://git.kernel.org/stable/c/47186409c092cd7dd70350999186c700233e854d",
        "https://git.kernel.org/stable/c/9684fff87124b201e11dea01ded9173025359a0f",
        "https://git.kernel.org/stable/c/b4ccd6eef671d7c44a30123cd29f3acf3de8468e",
        "https://git.kernel.org/stable/c/b8c90823cdfb5f3d22f261aeb3e9066612853c36",
        "https://git.kernel.org/stable/c/f01fb6138f8eb606b56ce9158e2d8b72352c53f4",
        "https://git.kernel.org/stable/c/fa26e4606aed0f7fe793c325506adeda1d847a43",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74262.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-74262",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74262.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-74262",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 496341,
  "published_at": "2026-08-15T05:57:38.99+00:00"
}