Linux Kernel: 17 Security Fixes in Networking, Ceph and MPTCP (CVE-2026-74746)

Summary

Parameter	Value
CVE ID	CVE-2026-74746 (primary) + 16 related
Alert Source	GitHub Advisory - Critical vulnerability
CVE Year	2026
Publication Date	2026-08-27
Vendor	Linux
Product	Linux kernel
CVSS Score	up to 9.8 (Critical)
EPSS Score	No data
CISA KEV	No
Ransomware	Not confirmed

Consolidated entry. This covers 17 Linux kernel vulnerabilities disclosed in the same batch. All are removed by a single kernel update from your distribution, so the administrator action is one, not seventeen.

We treat CVE-2026-53362 (IPv6) separately — it entered the CISA KEV catalog as actively exploited and has its own alert.

Vulnerability Description

Source: NVD / kernel.org

Networking subsystem

• CVE-2026-74746 (9.8) — netfilter/flowtable: publishing the tuple node in the wrong order lets the garbage collector observe and free a flow that is still in use (use-after-free).
• CVE-2026-74752 (9.8) — sctp: with cookie authentication disabled, AUTH fields are restored directly from peer-controlled cookie bytes. A forged RANDOM length or HMAC/CHUNKS list leads to memory corruption.
• CVE-2026-74743 and CVE-2026-74744 (both 9.8) — macvlan and ipvlan inherit hard_header_len from the lower device but leave needed_headroom and needed_tailroom at zero.
• CVE-2026-80519 (9.8) — ovpn: crypto callback cleanup completes after the peer reference is dropped, which can allow netdev unregistration while still in use.
• CVE-2026-74737 (9.8) — am65-cpsw-nuss (TI Ethernet): incorrect port ID extraction from the SRC tag in the RX DMA descriptor.

MPTCP

• CVE-2026-80586 (9.8) — DSS fields are not reset on unexpected option size; a remote peer can send a malformed DSS.
• CVE-2026-80587 (9.8) — combining mutually exclusive suboptions the code elsewhere does not expect.
• CVE-2026-80585 (9.4) — fastopen: marking MPTFO subflows even when a valid-cookie SYN carries no data.

Ceph

• CVE-2026-80557 (9.8) — libceph: out-of-bounds read in decode_watchers() from a missing bounds check (struct_len=0 is accepted as valid).
• CVE-2026-80561 (9.8) — libceph: three unsafe decode operations in decode_locker() allowing a malicious OSD to trigger slab out-of-bounds reads.
• CVE-2026-80558 (9.8) — libceph: a corrupted osdmap from a monitor may contain non-existent OSD indices in pg_temp, primary_temp, pg_upmap.
• CVE-2026-80528 (9.8) — ceph: an allocation while current->journal_info is set can enter filesystem reclaim.

Other

• CVE-2026-80589 (9.8) — block: the timeout timer is not stopped when releasing a disk that was never added (add_disk never ran after a failed probe).
• CVE-2026-74751 (9.4) — riscv: the ZBB-optimized strnlen loop reads one word past the given boundary.
• CVE-2026-80554 and CVE-2026-80551 (both 9.3) — s390/vfio_ccw: no limit on channel program segments during recursive processing, and ensuring the first IDAW remains constant.

Required Actions

1. Apply the kernel update from your distribution vendor (RHEL, SLES, Ubuntu, Debian) and reboot. Without a reboot the running kernel stays vulnerable.
2. If a reboot must wait, check whether your distribution offers live patching.
3. Prioritise hosts that actually use the affected subsystems: nodes with a Ceph client, systems with MPTCP enabled, container hosts using macvlan/ipvlan, and firewalls built on netfilter flowtable.
4. The s390/vfio_ccw flaws apply only to the IBM Z platform — if your organisation runs a mainframe, address them separately, as it often sits on a different maintenance cycle.

Who Is Affected?

The vulnerabilities affect systems running a Linux kernel older than the fixes listed.

In practice that means application and database servers, virtualisation hosts, Kubernetes nodes and Linux-based network appliances. Some flaws only matter under specific configurations — the libceph bugs apply to environments with Ceph storage, and s390 exclusively to IBM Z mainframes.

That selectivity is a practical hint: rather than treating the batch as seventeen separate tasks, determine which subsystems your organisation actually uses and start there. The kernel update closes all of them at once anyway.

Sources

• NVD - CVE-2026-74746
• kernel.org
• FIRST EPSS

---

Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.