CVE-2026-74310

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-use-after-free issue exists in the vhost-net component of the Linux kernel. The vhost zerocopy complete() function incorrectly treats every ubuf callback as a completed vhost descriptor, even when the callback only releases a cloned skb reference. This occurs because the function dereferences ubuf->ctx and drops the vhost net ubuf ref prematurely. Consequently, a backend reset may free the vhost net ubuf ref while a cloned skb still holds the same ubuf info, leading to a use-after-free when a subsequent completion dereferences the freed ubufs pointer. This behavior was observed during operations involving vhost net ioctl(), kfree rcu(), and kvfree rcu bulk().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.