CVE-2026-74566None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: keys: make keyring key-chunk byte order agree with keyring_diff_objects() keyring_get_key_chunk() loads description bytes into the index chunk low address first, while…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
keys: make keyring key-chunk byte order agree with keyring_diff_objects()
keyring_get_key_chunk() loads description bytes into the index chunk low address first, while keyring_diff_objects() numbers the first differing bit from the low end and folds the absolute byte index into the level without removing the inline-prefix offset the level already carries. The two disagree on byte order and bit position, so the array can be told two keys first differ at a bit that does not differ in the chunk the walker uses, letting crafted descriptions collide into one node.
Load the chunk in the order keyring_diff_objects() assumes and drop the inline-prefix length when folding the byte index into the level. This only changes the in-memory ordering used to place keys within a keyring; add, search and read of non-colliding keys are unaffected.
Linux >= f771fde82051976a6fc0fd570f8b86de4a92124b < 414bcf37d81ce9b3823aabc06b04c97fdcbe489bLinux >= f771fde82051976a6fc0fd570f8b86de4a92124b < abe43c661efb753d5ee35ad8ace4bbb16fa9afd0Linux >= f771fde82051976a6fc0fd570f8b86de4a92124b < f81920917074e3c4ad4fba06fe8c56738d010606Linux >= f771fde82051976a6fc0fd570f8b86de4a92124b < bd0f976ef89dce6db458bf75bc2cf51127becc41Linux >= f771fde82051976a6fc0fd570f8b86de4a92124b < 7269df3e7fcfa308e6a456305162f7788747bdbdLinux >= f771fde82051976a6fc0fd570f8b86de4a92124b < 3d9f16c0b643ceac305526b2e2fe25c2c6166926Linux >= f771fde82051976a6fc0fd570f8b86de4a92124b < 7e5397a3fed0dee7779bd084bec3c0584db3c930Linux >= f771fde82051976a6fc0fd570f8b86de4a92124b < 58565eef0f8d861aae92abfb7658458d661cee17Linux 5.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses