CVE-2026-74306

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-74306
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74306.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-74306
Downstream
Published
2026-08-15T05:58:07Z
Modified
2026-08-18T03:56:56Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
vfio/qat: fix f_pos race in qat_vf_resume_write()
Details

In the Linux kernel, the following vulnerability has been resolved:

vfio/qat: fix f_pos race in qat_vf_resume_write()

qat_vf_resume_write() checks filp->f_pos before taking migf->lock, but copies into the migration-state buffer after taking the lock and re-reading the shared file position.

Two concurrent writers could therefore pass the bounds check with the old offset, then have the second writer copy after the first advanced f_pos, writing past the end of the migration-state buffer.

Take migf->lock before doing the boundary checks.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74306.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
bb208810b1abf1c84870cfbe1cc9cf1a1d35c607
Fixed
6465af0004dc1b067129a26ef44f19cdf13bbce6
Fixed
d416dcefdbac90d96b22485fd93f28229ad9984b
Fixed
b6fd7a40a66485c8aa8156d8fcf50b95cb8ba281
Fixed
4ec5e932e636896e97e4c6a8205b0ac76d52421a

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74306.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.10.0
Fixed
6.12.97
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.40
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74306.json"