CVE-2026-74689 net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
A local attacker can trigger a slab-out-of-bounds read in the Linux kernel ATM subsystem, potentially leaking memory or causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74689?
CVE-2026-74689 is a high-severity memory corruption vulnerability in Linux, published on 22 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
vcc_setsockopt() contained an ineffective optlen check: if (__SO_LEVEL_MATCH(optname, level) && optlen != __SO_SIZE(optname)) return -EINVAL;
If __SO_LEVEL_MATCH(optname, level) evaluated to false (e.g. if the caller passed a mismatched level), the length check optlen != __SO_SIZE(optname) was short-circuited and bypassed. Execution then fell through to switch(optname), calling copy_from_sockptr() assuming optval contained sufficient space.
Furthermore, even if level matched, a cgroup BPF setsockopt filter could shrink optlen after entry. Because copy_from_sockptr() on kernel pointers uses memcpy(), this leads to a KASAN slab-out-of-bounds read when optlen is smaller than the expected structure size.
Fix this by using copy_safe_from_sockptr(), which unconditionally validates that optlen is at least the expected size before copying. Also change the local 'value' variable type from 'unsigned long' to 'int' so that SO_SETCLP matches its sizeof(int) ABI encoding on 64-bit systems.
Which versions are affected by CVE-2026-74689?
How do I fix CVE-2026-74689?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-74689 being exploited?
There is no known exploitation of CVE-2026-74689 in the wild and no public exploit code.
Sources
Also known as AZL-97070, BELL-CVE-2026-74689, DEBIAN-CVE-2026-74689, GHSA-gwfv-775p-2rj5, UBUNTU-CVE-2026-74689.