CVE-2026-74262

CVE-2026-74262 is a TOCTOU race in the Kernel Connection Multiplexor's callback attachment path. The vulnerability lives in how KCM assigns sk_data_ready and sk_write_space callbacks during attach/detach operations — plain stores to these function pointers occur without the WRITE_ONCE() barrier that protects against concurrent readers, creating a window where a dangling pointer dereference is possible if one thread reads while another writes. This is structurally identical to the callback-visibility issues addressed in prior fixes (the '4022' commits that added WRITE_ONCE() guards to similar paths in core socket code). The pattern is proven: plain store to a concurrently-read function pointer. The fix is one-line per site — adding WRITE_ONCE() to both callback assignments in the KCM attach path. What matters for defenders: this is not a novel vulnerability class, it's a known idiom with an incomplete audit trail. The kernel has fixed this exact pattern multiple times across different subsystems, yet each fix stands alone with no mechanism to trigger scanning for remaining instances. Your KCM exposure depends on whether your workload uses the kernel's connection multiplexer — primarily relevant for high-throughput proxy software and Kubernetes CNI stacks that multiplex connections at the application layer. The CVSS 7.8 reflects the direct exploitability, but the more significant risk is temporal: every system that received the earlier socket-layer callback fixes ran simultaneously with this unpatched KCM path, creating a compounding exposure that severity scores don't capture. Prioritise: patch immediately if you run KCM-based workloads. More broadly, treat any new WRITE_ONCE() fix for a concurrent-callback pattern as a signal to audit similar idioms in adjacent subsystems — the kernel's process converts pattern recognition into preventive action only through individual reports, not systematic sweeps. Expect this pattern to surface again in other multiplexers or shim layers that sit at subsystem interfaces where neither review team has cognitive ownership of the intersection.

Reviewed through automated stages and approved by a human before publication.