Look up another CVE · open CVE-2026-74662 in the interactive tracker
CVE-2026-74662
inet: frags: publish queues before arming timer
Published 2026-08-22 (2 months ago) by the Linux kernel CNA. Subsystem net/ipv4. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74662 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6477-1 · 2026-08-29 · text | 6.12.107-1 | Update the kernel and reboot. DSA-6477-1 shipped the fix on 2026-08-29, in 6.12.107-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/ipv4/inet_fragment.c
- What this is
- NETWORKING [IPv4/IPv6]MAINTAINERS section matched on net/ipv4/inet_fragment.c · netdev@vger.kernel.org · Maintained
Check it on the machine
grep -w CONFIG_INET /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12y
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_INET
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-22 (2 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.51%, higher than 42.5% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/ipv4
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.17 | 5.10.267 | f4e4dab62181 |
| 4.17 | 5.15.218 | 4ed0681dc2c1 |
| 4.17 | 6.1.185 | 08a04d7bfb9c |
| 4.17 | 6.6.154 | d3ffb89b2944 |
| 4.17 | 6.12.106 | 39c6c4b267b6 |
| 4.17 | 6.18.45 | 9f904dd3e455 |
| 4.17 | 7.1.9 | 928128865e43 |
| 4.17 | 7.2 | 653d7ddf6cba |
| 4.4.174 | 0 | 0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DSA-6477-1 | 2026-08-29 | trixie 6.12.107-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- IPv4/IPv6 fragments reach inet_frag_create() via remote receive paths (ip_defrag, ipv6_frag_rcv, nf_conntrack reassembly) on any Internet-facing host performing normal fragment reassembly before transport delivery.
- AC:LAttack complexity, low
- Requires per-netns fragment timeout ≤0 so the armed timer expires during queue creation; attacker-settable with CAP_NET_ADMIN in user/net namespaces, and the timer/hash race is fully attacker-controlled and repeatable via crafted fragments.
- PR:NPrivileges required, none
- No authentication or capability check gates IPv4/IPv6 fragment receive/reassembly before inet_frag_find(); remote peers can deliver the triggering fragmented traffic pre-authentication to hosts processing fragments.
- UI:NUser interaction, none
- Exploitation needs only crafted fragmented packet delivery; no victim action such as opening files, clicking links, or mounting filesystems is required.
- S:UScope, unchanged
- Corruption is confined to the kernel network stack in the same security authority; this is standard kernel memory corruption/privilege escalation, not a VM escape or IOMMU boundary bypass.
- C:HConfidentiality impact, high
- Incorrect refcounting leaves a stale rhashtable entry pointing at a freed inet_frag_queue; subsequent fragment lookups dereference freed slab memory, enabling kernel information disclosure primitives.
- I:HIntegrity impact, high
- Follow-on fragment handling on the stale queue writes through freed inet_frag_queue and skb linkage fields, yielding kernel heap corruption exploitable for arbitrary modification or code execution.
- A:HAvailability impact, high
- Freed-queue dereferences during reassembly can kernel oops or panic; attackers can retrigger the condition repeatedly by sending additional fragmented datagrams matching the same fragment key.