In the Linux kernel, the following vulnerability has been resolved:

vfio/qat: fix f_pos race in qat_vf_resume_write()

qat_vf_resume_write() checks filp->f_pos before taking migf->lock, but
copies into the migration-state buffer after taking the lock and
re-reading the shared file position.

Two concurrent writers could therefore pass the bounds check with the
old offset, then have the second writer copy after the first advanced
f_pos, writing past the end of the migration-state buffer.

Take migf->lock before doing the boundary checks.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
bb208810b1abf1c84870cfbe1cc9cf1a1d35c607 affected < 6465af0004dc1b067129a26ef44f19cdf13bbce6
bb208810b1abf1c84870cfbe1cc9cf1a1d35c607 affected < d416dcefdbac90d96b22485fd93f28229ad9984b
bb208810b1abf1c84870cfbe1cc9cf1a1d35c607 affected < b6fd7a40a66485c8aa8156d8fcf50b95cb8ba281
bb208810b1abf1c84870cfbe1cc9cf1a1d35c607 affected < 4ec5e932e636896e97e4c6a8205b0ac76d52421a
Linux Linux affected
Version Status Constraints
6.10 affected —
0 unaffected < 6.10
6.12.97 unaffected ≤ 6.12.*
6.18.40 unaffected ≤ 6.18.*
7.1.5 unaffected ≤ 7.1.*
7.2-rc1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/4ec5e932e636896e97e4c6a8205b0ac76d52421a cve-icon cve-icon
https://git.kernel.org/stable/c/6465af0004dc1b067129a26ef44f19cdf13bbce6 cve-icon cve-icon
https://git.kernel.org/stable/c/b6fd7a40a66485c8aa8156d8fcf50b95cb8ba281 cve-icon cve-icon
https://git.kernel.org/stable/c/d416dcefdbac90d96b22485fd93f28229ad9984b cve-icon cve-icon
History

Sat, 15 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-787

Sat, 15 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: vfio/qat: fix f_pos race in qat_vf_resume_write() qat_vf_resume_write() checks filp->f_pos before taking migf->lock, but copies into the migration-state buffer after taking the lock and re-reading the shared file position. Two concurrent writers could therefore pass the bounds check with the old offset, then have the second writer copy after the first advanced f_pos, writing past the end of the migration-state buffer. Take migf->lock before doing the boundary checks.
Title vfio/qat: fix f_pos race in qat_vf_resume_write()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:58:07.313Z

Reserved: 2026-08-15T05:44:03.883Z

Link: CVE-2026-74306

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:30.357

Modified: 2026-08-15T06:22:30.357

Link: CVE-2026-74306

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T12:30:07Z

Weaknesses