CVE-2026-74446

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold event_mutex…

Risk score: 62/100
CVSS: 7.8 v3.1
Exploit chance (30 days): 0.1%
Published: 15 Aug 2026

Open in the live forecast Today's forecast

What to know

What it is: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold event_mutex while checkpointing CRIU events kfd_criu_checkpoint_events() counts the entries in p->event_idr via kfd_get_num_events(), allocates an array sized to that count, and then walks the same IDR to fill it. Neither the count no…
Affected: Canonical Ubuntu Linux
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Canonical Ubuntu Linux: Red, act today. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart, or potential…

The flaws

CVE-2026-74446: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold event_mutex… (CVSS 7.8 · EPSS 0%)
CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)

The fix

Fix: Check the linked advisory for the concrete fix.

Who is exposed: {'products': ['NGINX Plus', 'NGINX Open Source'], 'packages': [], 'versions': []}

Where it stands

No known exploitation

How it unfolded

26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
3 Nov, Ubuntu security notices (official): USN-8960-1: Linux kernel (OEM) vulnerabilities
3 Nov, Ubuntu security notices (official): USN-8959-1: Linux kernel vulnerabilities

Connects to

Same weakness: Heap buffer overflow (CWE-122). 398 other warnings in 30 days
Same product: Earlier Canonical Ubuntu Linux warnings. 96 in the last 90 days

Why it is Amber

CVSS 7.8 high
On your watchlist: linux kernel
Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold event_mutex while checkpointing CRIU events kfd_criu_checkpoint_events() counts the entries in p->event_idr via kfd_get_num_events(), allocates an array sized to that count, and then walks the same IDR to fill it. Neither the count nor the walk holds p->event_mutex. The CRIU checkpoint caller holds only p->mutex. Event create and destroy (kfd_event_create()/kfd_event_destroy()) take p->event_mutex and do not take p->mutex, so a second thread in the same process can insert or remove events between the count and the walk. If an event is inserted, the walk iterates more entries than were counted and writes past the end of the ev_privs allocation; if an event is removed, the walk dereferences an entry that is being freed. Hold p->event_mutex across the count and the walk so both observe a consistent view of p->event_idr. The lock is released before copy_to_user(), which only touches the local buffer. The caller already holds p->mutex and the create/destroy paths never take p->mutex, so the p->mutex -> p->event_mutex order is not inverted and no deadlock is introduced. (cherry picked from commit ff57e223ab105795b05d3ef3f3c35a5a441bcbaa)

Last activity 3 Nov 2026. Patch Forecast updates every hour.