CVE-2026-74636: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-jcq2-873m-mp53
Share
Published
Advisory Summary

CVE-2026-74636 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-74636 at a Glance

CVE Identifier CVE-2026-74636
GHSA Identifier GHSA-jcq2-873m-mp53
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-74636

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-74636, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between update_event_fields and, event_define_fields The following sequence may leads race between event_define_fields() and update_event_fields(): CPU0 (loads module A) CPU1 (loads module B) =============================== =============================== load_module(A) load_module(B) notifier_call_chain notifier_call_chain trace_module_notify trace_module_notify mutex_lock(&event_mutex) trace_event_update_all() trace_module_add_events(A) down_write(&trace_event_sem) __register_event(call_A) __add_event_to_tracers(call_A) event_define_fields(call_A) for each f: list_for_each_entry(field, list_add(&f->link, &class->fields, link) &class->fields) field = class->fields->next; Where access to the class->fields is not protected by the event_mutex in trace_event_update_all(). This produces the following panic: Unable to handle kernel access ... at virtual address 0000000000000018 pc : update_event_fields+0xf8/0x368 Call trace: update_event_fields+0xf8/0x368 trace_event_update_all+0x7c/0x2b4 trace_module_notify+0x4c/0x1dc notifier_call_chain+0x84/0x168 blocking_notifier_call_chain_robust+0x64/0xd4 load_module+0x10c8/0x123c __arm64_sys_finit_module+0x230/0x31c Fix by taking event_mutex in trace_event_update_all() before trace_event_sem.

References

NVD — CVE-2026-74636 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-74636
git.kernel.org/stable/c/4e39f7b4d9... WEB
https://git.kernel.org/stable/c/4e39f7b4d9d36508c53e89e6cbc640728df870b5
git.kernel.org/stable/c/a30d421468... WEB
https://git.kernel.org/stable/c/a30d421468300b1e7b2f233136aeb2db8013f555
git.kernel.org/stable/c/c3730b8373... WEB
https://git.kernel.org/stable/c/c3730b8373bb5059d735509b9e6a00d7eb337d7c
git.kernel.org/stable/c/e5f1d301b4... WEB
https://git.kernel.org/stable/c/e5f1d301b4bdaa4206db251fdc691f623162b0a8
git.kernel.org/stable/c/ed49684e69... WEB
https://git.kernel.org/stable/c/ed49684e69f846bf50b5050651ccdb87cfd152c0
git.kernel.org/stable/c/f128740f39... WEB
https://git.kernel.org/stable/c/f128740f39ab28d1f4ad5bdd10f3e117eec0c374
git.kernel.org/stable/c/fdeb190b09... WEB
https://git.kernel.org/stable/c/fdeb190b0905a6aaed1e5d6adfb8613214748d7d

Frequently Asked Questions

What is CVE-2026-74636?
CVE-2026-74636 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-74636?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-74636?
CVE-2026-74636 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-74636?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jcq2-873m-mp53",
  "modified" : "2026-08-22T18:30:27Z",
  "published" : "2026-08-22T18:30:27Z",
  "aliases" : [ "CVE-2026-74636" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix race between update_event_fields and, event_define_fields\n\nThe following sequence may leads race between event_define_fields()\nand update_event_fields():\n\n CPU0 (loads module A)                      CPU1 (loads module B)\n ===============================            ===============================\n load_module(A)                             load_module(B)\n   notifier_call_chain                        notifier_call_chain\n     trace_module_notify                        trace_module_notify\n       mutex_lock(&event_mutex)                   trace_event_update_all()\n         trace_module_add_events(A)                 down_write(&trace_event_sem)\n            __register_event(call_A)\n              __add_event_to_tracers(call_A)\n                event_define_fields(call_A)\n                  for each f:                         list_for_each_entry(field,\n                    list_add(&f->link,                                    &class->fields, link)\n                             &class->fields)            field = class->fields->next;\n\nWhere access to the class->fields is not protected by the event_mutex in\ntrace_event_update_all().\n\nThis produces the following panic:\n   Unable to handle kernel access ... at virtual address 0000000000000018\n   pc : update_event_fields+0xf8/0x368\n   Call trace:\n    update_event_fields+0xf8/0x368\n    trace_event_update_all+0x7c/0x2b4\n    trace_module_notify+0x4c/0x1dc\n    notifier_call_chain+0x84/0x168\n    blocking_notifier_call_chain_robust+0x64/0xd4\n    load_module+0x10c8/0x123c\n    __arm64_sys_finit_module+0x230/0x31c\n\nFix by taking event_mutex in trace_event_update_all() before\ntrace_event_sem.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-74636"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4e39f7b4d9d36508c53e89e6cbc640728df870b5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a30d421468300b1e7b2f233136aeb2db8013f555"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c3730b8373bb5059d735509b9e6a00d7eb337d7c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e5f1d301b4bdaa4206db251fdc691f623162b0a8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ed49684e69f846bf50b5050651ccdb87cfd152c0"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f128740f39ab28d1f4ad5bdd10f3e117eec0c374"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fdeb190b0905a6aaed1e5d6adfb8613214748d7d"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-22T16:16:36Z"
  }
}