# inet: frags: publish queues before arming timer

CVE record · `CVE-2026-74662`

- **Identifiers:** `CVE-2026-74662`
- **State:** Confirmed
- **Severity:** CVSS 9.8 Critical
- **Critical:** Yes: CVSS 9+
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 22 Aug 2026
- **Updated:** 16 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 22 Aug 2026, 15:32 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Critical

Critical, because:

- CVSS score 9.8: 9.0 or more.

How we decide what’s critical: <https://agentprime.io/advisories/critical.md>

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `648700f76b03b7e8149d13cc2bdb3355035258a9 to before f4e4dab62181b7fe7c011bed6fbef9fc3d48c769` (git)
  - affected: `648700f76b03b7e8149d13cc2bdb3355035258a9 to before 4ed0681dc2c1e0538b79d2fc56190ffcb369dacd` (git)
  - affected: `648700f76b03b7e8149d13cc2bdb3355035258a9 to before 08a04d7bfb9c103432561aff8a62b6872e694a6a` (git)
  - affected: `648700f76b03b7e8149d13cc2bdb3355035258a9 to before d3ffb89b2944672cf7bdd8e9ee577d2043b4a956` (git)
  - affected: `648700f76b03b7e8149d13cc2bdb3355035258a9 to before 39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0` (git)
  - affected: `648700f76b03b7e8149d13cc2bdb3355035258a9 to before 9f904dd3e455750e5d4ec9b2f134835811b85a2f` (git)
  - affected: `648700f76b03b7e8149d13cc2bdb3355035258a9 to before 928128865e43b197e30688dc1bc991592c97edcf` (git)
  - affected: `648700f76b03b7e8149d13cc2bdb3355035258a9 to before 653d7ddf6cba867777a3d14c4f83ace008c5ad13` (git)
  - affected: `493107105843f299662b3b664a83804645564f12` (git)
  - affected: `4.4.174 to before 4.5` (semver)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `4.17`
  - unaffected: `before 4.17` (semver)
  - unaffected: `5.10.267 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.218 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.185 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.154 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.106 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.45 to 6.18.*, inclusive` (semver)
  - unaffected: `7.1.9 to 7.1.*, inclusive` (semver)
  - unaffected: `7.2 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 9.8 Critical, CVSS 3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0051, the 44th percentile, on 15 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 22 Aug 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-74662](https://www.cve.org/CVERecord?id=CVE-2026-74662)
- [NVD: CVE-2026-74662](https://nvd.nist.gov/vuln/detail/CVE-2026-74662)

### References from the CNA

- <https://git.kernel.org/stable/c/f4e4dab62181b7fe7c011bed6fbef9fc3d48c769>
- <https://git.kernel.org/stable/c/4ed0681dc2c1e0538b79d2fc56190ffcb369dacd>
- <https://git.kernel.org/stable/c/08a04d7bfb9c103432561aff8a62b6872e694a6a>
- <https://git.kernel.org/stable/c/d3ffb89b2944672cf7bdd8e9ee577d2043b4a956>
- <https://git.kernel.org/stable/c/39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0>
- <https://git.kernel.org/stable/c/9f904dd3e455750e5d4ec9b2f134835811b85a2f>
- <https://git.kernel.org/stable/c/928128865e43b197e30688dc1bc991592c97edcf>
- <https://git.kernel.org/stable/c/653d7ddf6cba867777a3d14c4f83ace008c5ad13>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-74662>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-74662/>. Everything for agents: <https://agentprime.io/llms.txt>.