CVE-2026-74466: Linux vulnerability

CVE-2026-74466: s390/zcrypt: Close speculative mem read possibility

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions (custom device node used, administrative load) this value is used as an array index after bounds checking, but without speculation barrier. Add the missing array_index_nospec() call to prevent speculative execution where this domain value is used.

UnknownCVSS not scoredNot KEV-listedUpdatedOct 15, 2026, 10:09 UTC (UTC+00:00)

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-74466 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Aug 15, 2026, 12:27 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

3Timeline events

0ADP providers

4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
Aug 15, 2026, 05:44 UTC (UTC+00:00)
CVE publishedCVE Program
The CVE record was published.
Aug 15, 2026, 12:27 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Oct 15, 2026, 10:09 UTC (UTC+00:00)

Source materials

CVE List V5 sourceCVE List V5
https://git.kernel.org/stable/c/59adeedebf02aa1c203de1d2b67ec45bfab7a3c6CVE reference, Linux
https://git.kernel.org/stable/c/82b62eda68abfb7a33ac40f24b8c4128c2891148CVE reference, Linux
https://git.kernel.org/stable/c/e935cd525af4c6ed2e2c6404aa27ca19c7f39ddbCVE reference, Linux

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

LinuxLinuxcfd68b33094e1a92249850ff3c3c92ae9112a541, cfd68b33094e1a92249850ff3c3c92ae9112a541, cfd68b33094e1a92249850ff3c3c92ae9112a541unaffected

LinuxLinux5.18, 0, 6.18.57, 7.1.8, 7.2affected

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.