CVE-2026-74726: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-33v4-fjq4-gjwg
Share
CVSS 7.3
Published
Advisory Summary

CVE-2026-74726 is a HIGH (CVSS 7.3) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-74726 at a Glance

CVE Identifier CVE-2026-74726
GHSA Identifier GHSA-33v4-fjq4-gjwg
Severity HIGH
CVSS v3.1 Base Score 7.3
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity Low (I:L)
Availability High (A:H)

How to Fix CVE-2026-74726

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-74726, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing the promiscuity it set on the active slave. In that window the active slave can change under RTNL (RTM_DELLINK -> __bond_release_one() -> bond_alb_handle_active_change()), which already drops the promiscuity and clears primary_is_promisc. The monitor still acts on the stale decision: if the slave was removed with no failover, curr_active_slave is now NULL and the deref faults; if it failed over, the stale dev_set_promiscuity(-1) underflows the new slave's promiscuity counter and pins it in IFF_PROMISC. Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: b42 bond_alb_monitor RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) Kernel panic - not syncing: Fatal exception Re-check primary_is_promisc (and curr_active_slave) after taking RTNL so the monitor only undoes an increment it still owns. The other bonding monitors already re-read state under RTNL in their commit phase (bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only one acting on the pre-trylock decision.

References

NVD — CVE-2026-74726 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-74726
git.kernel.org/stable/c/09add8d5cf... WEB
https://git.kernel.org/stable/c/09add8d5cfa9c46828f51eaad162c36e86366b71
git.kernel.org/stable/c/257c4a3a34... WEB
https://git.kernel.org/stable/c/257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2
git.kernel.org/stable/c/2faf75a8a0... WEB
https://git.kernel.org/stable/c/2faf75a8a06504071b4c0aea7e45a9cc49a4e187
git.kernel.org/stable/c/683c6ba6e5... WEB
https://git.kernel.org/stable/c/683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d
git.kernel.org/stable/c/b82f51681a... WEB
https://git.kernel.org/stable/c/b82f51681a7a88c7d3c865e817a3340d42b5fa2a
git.kernel.org/stable/c/dccec0227e... WEB
https://git.kernel.org/stable/c/dccec0227ed8d9e36936d66e256b957dc2858468
git.kernel.org/stable/c/dd148539fb... WEB
https://git.kernel.org/stable/c/dd148539fb4741d01c06b7d2c8bd84b01920756c
git.kernel.org/stable/c/f7668762bf... WEB
https://git.kernel.org/stable/c/f7668762bf5fd6db9397de5c0514407489d9d815

Frequently Asked Questions

What is CVE-2026-74726?
CVE-2026-74726 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-74726?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-74726?
CVE-2026-74726 has a CVSS v3.1 base score of 7.3 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H.
What CWE is associated with CVE-2026-74726?
CVE-2026-74726 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-74726?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-33v4-fjq4-gjwg",
  "modified" : "2026-08-25T06:31:30Z",
  "published" : "2026-08-22T18:30:30Z",
  "aliases" : [ "CVE-2026-74726" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor\n\nbond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and\ntakes RTNL via rtnl_trylock() before undoing the promiscuity it set on the\nactive slave. In that window the active slave can change under RTNL\n(RTM_DELLINK -> __bond_release_one() -> bond_alb_handle_active_change()),\nwhich already drops the promiscuity and clears primary_is_promisc. The\nmonitor still acts on the stale decision: if the slave was removed with no\nfailover, curr_active_slave is now NULL and the deref faults; if it failed\nover, the stale dev_set_promiscuity(-1) underflows the new slave's\npromiscuity counter and pins it in IFF_PROMISC.\n\n  Oops: general protection fault, probably for non-canonical address ...\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n  Workqueue: b42 bond_alb_monitor\n  RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600)\n   process_one_work (kernel/workqueue.c:3322)\n   worker_thread (kernel/workqueue.c:3486)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n  Kernel panic - not syncing: Fatal exception\n\nRe-check primary_is_promisc (and curr_active_slave) after taking RTNL so\nthe monitor only undoes an increment it still owns. The other bonding\nmonitors already re-read state under RTNL in their commit phase\n(bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only\none acting on the pre-trylock decision.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-74726"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/09add8d5cfa9c46828f51eaad162c36e86366b71"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2faf75a8a06504071b4c0aea7e45a9cc49a4e187"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b82f51681a7a88c7d3c865e817a3340d42b5fa2a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/dccec0227ed8d9e36936d66e256b957dc2858468"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/dd148539fb4741d01c06b7d2c8bd84b01920756c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f7668762bf5fd6db9397de5c0514407489d9d815"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-22T16:16:47Z"
  }
}