CVE-2026-74386: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-3685-2pvg-g2mr
Share
Published
Advisory Summary

CVE-2026-74386 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-74386 at a Glance

CVE Identifier CVE-2026-74386
GHSA Identifier GHSA-3685-2pvg-g2mr
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-74386

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-74386, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix page fragment cache leak in error path In nvmet_tcp_alloc_queue(), when a connection is closed during the allocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN), the error handling jumps to out_destroy_sq and then to out_ida_remove without draining the page fragment cache. Although nvmet_tcp_free_cmd() is called in some error paths to release individual page fragments, the underlying page cache reference held by queue->pf_cache is never released. The first allocation using pf_cache is the call to nvmet_tcp_alloc_cmd() for queue->connect, which happens after ida_alloc() returns successfully. This results in a page leak each time a connection fails during allocation, which could lead to memory exhaustion over time if connections are repeatedly opened and closed. Fix this by calling page_frag_cache_drain() before freeing the queue structure in the out_ida_remove label.

References

NVD — CVE-2026-74386 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-74386
git.kernel.org/stable/c/4dae393956... WEB
https://git.kernel.org/stable/c/4dae393956093c807212918fd91a8fc70df15338
git.kernel.org/stable/c/5fbe83a374... WEB
https://git.kernel.org/stable/c/5fbe83a374f09561a0f0c1f4aa021501ffd681eb
git.kernel.org/stable/c/a43a9abc1e... WEB
https://git.kernel.org/stable/c/a43a9abc1ebf663f0aa56a729106f68dd9c77da6
git.kernel.org/stable/c/ba3209704b... WEB
https://git.kernel.org/stable/c/ba3209704b3cd46961e4e081af5c52a780785648

Frequently Asked Questions

What is CVE-2026-74386?
CVE-2026-74386 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-74386?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-74386?
CVE-2026-74386 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-74386?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3685-2pvg-g2mr",
  "modified" : "2026-08-15T06:32:32Z",
  "published" : "2026-08-15T06:32:32Z",
  "aliases" : [ "CVE-2026-74386" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: fix page fragment cache leak in error path\n\nIn nvmet_tcp_alloc_queue(), when a connection is closed during the\nallocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN),\nthe error handling jumps to out_destroy_sq and then to out_ida_remove\nwithout draining the page fragment cache.\n\nAlthough nvmet_tcp_free_cmd() is called in some error paths to release\nindividual page fragments, the underlying page cache reference held by\nqueue->pf_cache is never released. The first allocation using pf_cache\nis the call to nvmet_tcp_alloc_cmd() for queue->connect, which happens\nafter ida_alloc() returns successfully. This results in a page leak each\ntime a connection fails during allocation, which could lead to memory\nexhaustion over time if connections are repeatedly opened and closed.\n\nFix this by calling page_frag_cache_drain() before freeing the queue\nstructure in the out_ida_remove label.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-74386"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4dae393956093c807212918fd91a8fc70df15338"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5fbe83a374f09561a0f0c1f4aa021501ffd681eb"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a43a9abc1ebf663f0aa56a729106f68dd9c77da6"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ba3209704b3cd46961e4e081af5c52a780785648"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:22:40Z"
  }
}