{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-74264 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-74264 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-74264 and fix it if it is affected.\n\nWhat it is: CVE-2026-74264 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-74264 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-74264/ (Markdown: https://insights.sbomify.com/CVE-2026-74264/index.md)","id":"CVE-2026-74264","markdown":"https://insights.sbomify.com/CVE-2026-74264/index.md","name":"CVE-2026-74264","record":{"aliases":["AZL-96027","BELL-CVE-2026-74264","DEBIAN-CVE-2026-74264","GHSA-6cq5-2879-x586","UBUNTU-CVE-2026-74264"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A race condition in the Linux kernel network watchdog allows concurrent access to reference tracking data, causing list corruption and system crashes.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: watchdog: fix refcount tracking races\n\nBlamed commit converted the untracked dev_hold()/dev_put() calls\nin the watchdog code to use the tracked dev_hold_track()/dev_put_track()\n(which were later renamed/interfaced to netdev_hold() and netdev_put()).\n\nBy introducing dev-\u003ewatchdog_dev_tracker to store the\nreference tracking information without adding synchronization\nbetween netdev_watchdog_up() and dev_watchdog(), it enabled the\nrace condition where this pointer could be overwritten or freed\nconcurrently, leading to the list corruption crash syzbot reported:\n\nlist_del corruption, ffff888114a18c00-\u003enext is NULL\n kernel BUG at lib/list_debug.c:52 !\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 1 UID: 0 PID: 91 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(lazy)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026\nWorkqueue: events_unbound linkwatch_event\n RIP: 0010:__list_del_entry_valid_or_report.cold+0x22/0x2a lib/list_debug.c:52\nCall Trace:\n \u003cTASK\u003e\n  __list_del_entry_valid include/linux/list.h:132 [inline]\n  __list_del_entry include/linux/list.h:246 [inline]\n  list_move_tail include/linux/list.h:341 [inline]\n  ref_tracker_free+0x1a7/0x6c0 lib/ref_tracker.c:329\n  netdev_tracker_free include/linux/netdevice.h:4491 [inline]\n  netdev_put include/linux/netdevice.h:4508 [inline]\n  netdev_put include/linux/netdevice.h:4504 [inline]\n  netdev_watchdog_down net/sched/sch_generic.c:600 [inline]\n  dev_deactivate_many+0x28c/0xfe0 net/sched/sch_generic.c:1363\n  dev_deactivate+0x109/0x1d0 net/sched/sch_generic.c:1397\n  linkwatch_do_dev net/core/link_watch.c:184 [inline]\n  linkwatch_do_dev+0xd3/0x120 net/core/link_watch.c:166\n  __linkwatch_run_queue+0x3a5/0x810 net/core/link_watch.c:240\n  linkwatch_event+0x8f/0xc0 net/core/link_watch.c:314\n  process_one_work+0xa0e/0x1980 kernel/workqueue.c:3314\n  process_scheduled_works kernel/workqueue.c:3397 [inline]\n  worker_thread+0x5ef/0xe50 kernel/workqueue.c:3478\n  kthread+0x370/0x450 kernel/kthread.c:436\n  ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n\nThis patch has three coordinated parts:\n\n1) Add dev-\u003ewatchdog_lock and dev-\u003ewatchdog_ref_held to serialize watchdog operations.\n\n2) Remove netdev_watchdog_up() call from netif_carrier_on():\n   This ensures netdev_watchdog_up() is only called from process/BH context\n   (via linkwatch workqueue dev_activate()), allowing us to use\n   spin_lock_bh() for synchronization.\n\n3) Synchronize watchdog up and watchdog timer:\n   Protect netdev_watchdog_up() with tx_global_lock and watchdog_lock.\n   Only allocate a new tracker in netdev_watchdog_up() if one is\n   not already present.\n   In dev_watchdog(), ensure we don't release the tracker if the\n   timer was rescheduled either by dev_watchdog() itself or concurrently\n   by netdev_watchdog_up().","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"net: watchdog: fix refcount tracking races","id":"CVE-2026-74264","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"net: mana: initialize gdma queue id to INVALID_QUEUE_ID","id":"CVE-2026-74265"},"packages":[],"prev":{"headline":"net: wwan: t7xx: check skb_clone in control TX","id":"CVE-2026-74263"},"products":["Linux"],"published":"2026-08-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A race condition in the Linux kernel network watchdog allows concurrent access to reference tracking data, causing list corruption and system crashes.","url":"https://insights.sbomify.com/CVE-2026-74264/"}