CVE-2026-74662
In the Linux kernel, the following vulnerability has been resolved:
inet: frags: publish queues before arming timer
inet_frag_create() arms the fragment queue timer before inserting the
queue into the fqdir rhashtable. If the namespace fragment timeout is
zero or negative, the timer can run before the queue is published.
The timer callback then marks the queue complete, tries to remove a node
that is not in the hash table yet, and drops the anticipated hash
reference. Creation can subsequently publish the completed queue without
restoring that reference, leaving a stale hash node after the caller drops
the remaining reference.
Publish the queue first and arm the timer while holding the queue lock.
This makes timer expiry wait until the queue is visible in the hash table,
so inet_frag_kill() can remove the node and balance the hash reference.
CSIRTS triage
- What
- A race condition in inet fragment queue handling where the timer is armed before queues are fully published, causing potential reassembly failures.
- Who is affected
- Systems running affected Linux kernel versions with IPv4 fragmentation processing.
- Urgency
- Medium priority; not exploited but can cause denial of service through incomplete fragment reassembly.
- Action
- Apply Linux kernel patch that publishes queues before arming the reassembly timer.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-74662
Get an email if CVE-2026-74662 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
Advisory coverage (2)
- criticalCVE-2026-74662: In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queue…nvd · 2026-08-22
- mediumCVE-2026-74662: inet: frags: publish queues before arming timermsrc · 2026-08-11
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-74662)