What’s Vulnerable › Vulnerabilities

CVE-2026-74262: kcm: use WRITE_ONCE() when changing lower socket callbacks

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-15 · updated 2026-10-16

Description

In the Linux kernel, the following vulnerability has been resolved: kcm: use WRITE_ONCE() when changing lower socket callbacks kcm_attach() replaces a live lower TCP socket's sk_data_ready and sk_write_space callbacks with KCM handlers, and kcm_unattach() restores them later. Those callback-pointer updates are still plain stores even though the same fields can be read and invoked concurrently on other CPUs. If another CPU observes an older callback snapshot after the live field has already been restored, callback execution can run with a mismatched target and sk_user_data state, leading to stale or misdirected wakeups. Use WRITE_ONCE() for the callback replacement and restore operations so these shared callback fields follow the same visibility contract already established by the earlier 4022 fixes.

Affected products

• Linux kernel: 4.6 — fixed in 7.2

How to fix

Upgrade to a fixed version: Linux kernel 7.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0cb3e2f40679032c1aa2186280a86e5ead0161ee
• https://git.kernel.org/stable/c/11faefd11ce2448bac7279ab302dd1954a6547fe
• https://git.kernel.org/stable/c/47186409c092cd7dd70350999186c700233e854d
• https://git.kernel.org/stable/c/9684fff87124b201e11dea01ded9173025359a0f
• https://git.kernel.org/stable/c/b4ccd6eef671d7c44a30123cd29f3acf3de8468e
• https://git.kernel.org/stable/c/b8c90823cdfb5f3d22f261aeb3e9066612853c36
• https://git.kernel.org/stable/c/f01fb6138f8eb606b56ce9158e2d8b72352c53f4
• https://git.kernel.org/stable/c/fa26e4606aed0f7fe793c325506adeda1d847a43

Get alerted when CVE-2026-74262 or the next vulnerability affects your stack