---
id: CVE-2026-74262
title: 'kcm: use WRITE_ONCE() when changing lower socket callbacks'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  kcm: use WRITE_ONCE() when changing lower socket callbacks

  kcm_attach() replaces a live lower TCP socket's sk_data_ready and
  sk_write_space callbacks with KCM handlers…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 <
    0cb3e2f40679032c1aa2186280a86e5ead0161ee
  - >-
    Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 <
    fa26e4606aed0f7fe793c325506adeda1d847a43
  - >-
    Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 <
    b4ccd6eef671d7c44a30123cd29f3acf3de8468e
  - >-
    Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 <
    b8c90823cdfb5f3d22f261aeb3e9066612853c36
  - >-
    Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 <
    11faefd11ce2448bac7279ab302dd1954a6547fe
  - >-
    Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 <
    f01fb6138f8eb606b56ce9158e2d8b72352c53f4
  - >-
    Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 <
    9684fff87124b201e11dea01ded9173025359a0f
  - >-
    Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 <
    47186409c092cd7dd70350999186c700233e854d
  - Linux 4.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:51:36.196045Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:28.552Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74262'
references:
  - url: 'https://git.kernel.org/stable/c/0cb3e2f40679032c1aa2186280a86e5ead0161ee'
  - url: 'https://git.kernel.org/stable/c/fa26e4606aed0f7fe793c325506adeda1d847a43'
  - url: 'https://git.kernel.org/stable/c/b4ccd6eef671d7c44a30123cd29f3acf3de8468e'
  - url: 'https://git.kernel.org/stable/c/b8c90823cdfb5f3d22f261aeb3e9066612853c36'
  - url: 'https://git.kernel.org/stable/c/11faefd11ce2448bac7279ab302dd1954a6547fe'
  - url: 'https://git.kernel.org/stable/c/f01fb6138f8eb606b56ce9158e2d8b72352c53f4'
  - url: 'https://git.kernel.org/stable/c/9684fff87124b201e11dea01ded9173025359a0f'
  - url: 'https://git.kernel.org/stable/c/47186409c092cd7dd70350999186c700233e854d'
tags:
  - cve.org
epss: 0.00185
epssPercentile: 0.07589
ingestedAt: '2026-10-16T19:46:24.388Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

kcm: use WRITE_ONCE() when changing lower socket callbacks

kcm_attach() replaces a live lower TCP socket's sk_data_ready and
sk_write_space callbacks with KCM handlers, and kcm_unattach() restores
them later. Those callback-pointer updates are still plain stores even
though the same fields can be read and invoked concurrently on other
CPUs.

If another CPU observes an older callback snapshot after the live field
has already been restored, callback execution can run with a mismatched
target and sk_user_data state, leading to stale or misdirected wakeups.

Use WRITE_ONCE() for the callback replacement and restore operations so
these shared callback fields follow the same visibility contract already
established by the earlier 4022 fixes.

## Affected

- `Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < 0cb3e2f40679032c1aa2186280a86e5ead0161ee`
- `Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < fa26e4606aed0f7fe793c325506adeda1d847a43`
- `Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < b4ccd6eef671d7c44a30123cd29f3acf3de8468e`
- `Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < b8c90823cdfb5f3d22f261aeb3e9066612853c36`
- `Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < 11faefd11ce2448bac7279ab302dd1954a6547fe`
- `Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < f01fb6138f8eb606b56ce9158e2d8b72352c53f4`
- `Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < 9684fff87124b201e11dea01ded9173025359a0f`
- `Linux >= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < 47186409c092cd7dd70350999186c700233e854d`
- `Linux 4.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.