# CVE-2026-74729 — Linux

> As of 2026-08-22, CVE-2026-74729 is a vulnerability in Linux, EPSS 0.1% (9.8th percentile). No Threadlinqs-tracked threat campaign has been attributed to CVE-2026-74729 as of 2026-08-22; the identifier is re-checked against the Threadlinqs threat corpus on every daily ingest.

**Last updated:** 2026-08-22

## What is CVE-2026-74729?

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read put_fifo_with_discard() acts as both producer and consumer on the kfifo: it calls kfifo_skip() (advances out) and kfifo_put() (advances in) from the IRQ handler without synchronizing with snoop_file_read(), which also consumes via kfifo_to_user(). On SMP systems this concurrent access can leave (in - out) larger than the ring buffer, so __kfifo_to_user()'s clamp to (in - out) is ineffective and kfifo_copy_to_user() can attempt a copy_to_user() past the kmalloc-2k backing store: usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-2k' (offset 0, size 2049)! kernel BUG at mm/usercopy.c! Call trace: usercopy_abort __check_heap_object __check_object_size kfifo_copy_to_user __kfifo_to_user snoop_file_read vfs_read Serialize kfifo access with a per-channel spinlock shared between the IRQ handler (producer) and the file reader (consumer). Annotate @fifo with __guarded_by(&lock) and opt the driver into context analysis so the compiler enforces that all fifo access holds the lock.

1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 44 days ago.

## Severity and exploitation probability

- **EPSS (FIRST):** 0.1% probability of exploitation in the next 30 days, higher than 9.8% of all scored CVEs
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Threadlinqs priority:** 0.4/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- **Published:** 2026-08-22

## Is CVE-2026-74729 being exploited?

It currently carries a trending score of 32 in the Threadlinqs vulnerability feed.

## Affected products and versions

- [Linux](https://intel.threadlinqs.com/vendors/linux): Linux

## How to fix CVE-2026-74729

No vendor patch reference has been recorded for CVE-2026-74729 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2026-74729

No threat campaign in the Threadlinqs corpus currently references CVE-2026-74729, in its CVE list or as an indicator. The linkage is recomputed from the live corpus on every daily ingest, so this section fills in as soon as a tracked campaign cites the identifier.

## Sources

Enriched from CVE.org, FIRST EPSS. Last verified by Threadlinqs on 2026-08-23.

**Other references**

- [git.kernel.org](https://git.kernel.org/stable/c/131ab677b03349a5ae48da8722ec7075b37ec66e)
- [git.kernel.org (1acef6d85bfd98bd9dfe1f08bffa397a4dda8a6f)](https://git.kernel.org/stable/c/1acef6d85bfd98bd9dfe1f08bffa397a4dda8a6f)

Canonical: https://intel.threadlinqs.com/cve/CVE-2026-74729
Full detection coverage and IOCs for threats exploiting CVE-2026-74729 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp