CVE-2026-74590

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bug is only reachable via bpf_get_fsverity_digest(), a BPF kfunc callable from BPF LSM programs loaded through the bpf(2) syscall and triggered by local LSM hooks such as file_open, not by any network-facing kernel service.

AC:LAttack complexity, low

Exploitation requires racing concurrent writes to the dynptr-backed fsverity_digest buffer (e.g., bpf_map_update_elem from a sibling thread) against the kfunc's memset; the attacker controls both sides of this race and can repeat it until the bad offset is hit.

PR:LPrivileges required, low

Loading and attaching the required BPF LSM program needs CAP_BPF and CAP_PERFMON, which an unprivileged user can obtain as root inside a user namespace (unshare -Ur) without init-namespace privileges, matching kernel CNA guidance for BPF reachability.

UI:NUser interaction, none

No victim interaction is required; the attacker can load the LSM program, prepare a shared dynptr buffer, enable fsverity on a file they own, and trigger file_open themselves to invoke the vulnerable kfunc.

S:UScope, unchanged

Successful exploitation corrupts kernel heap memory and can yield local privilege escalation within the same kernel/host security boundary; it does not by itself cross a guest-to-host, sandbox, or IOMMU isolation boundary.

C:HConfidentiality impact, high

Concurrent tampering with digest_size lets memset() use an attacker-chosen offset beyond the dynptr allocation, causing out-of-bounds kernel heap writes that can corrupt adjacent objects and be leveraged for arbitrary kernel memory disclosure.

I:HIntegrity impact, high

The faulty memset() can write large zeroed regions far outside the dynptr buffer, giving a controllable out-of-bounds heap write primitive that is exploitable for control-flow hijacking and arbitrary kernel code execution.

A:HAvailability impact, high

An out-of-bounds heap write from kernel context can immediately oops/panic the kernel or destabilize critical structures, and the underlying memory corruption reliably threatens system availability even before full exploitation.