{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-74404 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-74404 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-74404 and fix it if it is affected.\n\nWhat it is: CVE-2026-74404 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-74404 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-74404/ (Markdown: https://insights.sbomify.com/CVE-2026-74404/index.md)","id":"CVE-2026-74404","markdown":"https://insights.sbomify.com/CVE-2026-74404/index.md","name":"CVE-2026-74404","record":{"aliases":["BELL-CVE-2026-74404","DEBIAN-CVE-2026-74404","GHSA-grxx-h4mr-vfpg","UBUNTU-CVE-2026-74404"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"An off-by-one error in the Linux kernel's CCP driver allows heap buffer overflow, potentially enabling code execution or privilege escalation.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one\n\nSashiko notes:\n\n\u003e regarding the bounds check in snp_filter_reserved_mem_regions()\n\u003e called via walk_iomem_res_desc(): does the check\n\u003e if ((range_list-\u003enum_elements * 16 + 8) \u003e PAGE_SIZE)\n\u003e allow an off-by-one heap buffer overflow?\n\u003e\n\u003e If range_list-\u003enum_elements is 255, 255 * 16 + 8 = 4088, which is \u003c= 4096.\n\u003e Writing range-\u003ebase (8 bytes) fills 4088-4095, but writing range-\u003epage_count\n\u003e (4 bytes) would write to 4096-4099, overflowing the kzalloc-allocated\n\u003e PAGE_SIZE buffer.\n\nFix this by accounting for the entry about to be written to, in addition to\nthe entries that are already allocated.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one","id":"CVE-2026-74404","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"OPP: Fix race between OPP addition and lookup","id":"CVE-2026-74405"},"packages":[],"prev":{"headline":"crypto: ccp - Check for page allocation failure correctly in TIO","id":"CVE-2026-74403"},"products":["Linux"],"published":"2026-08-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-16","vendors":["Linux"]},"summary":"An off-by-one error in the Linux kernel's CCP driver allows heap buffer overflow, potentially enabling code execution or privilege escalation.","url":"https://insights.sbomify.com/CVE-2026-74404/"}