CVE-2026-90143: Linux 4.9

CVE-2026-90143 affects azl3 kernel 6.6.150.1-1 on Azure Linux 3.0. CVSS 3.1 base score 7.8 (HIGH, Source advisory). EPSS 0.00176 (percentile 0.06638), scored 17-Oct-2026.

Affected technology

Linux · 9b73896a81dc68a638a011877b7344b252f92276 to before 37108861cf7bd909d4a372069bcd61c8f489e232, 9b73896a81dc68a638a011877b7344b252f92276 to before 3c70d27e792a28bca650ddd8a9aa0fe3591ffec5, 9b73896a81dc68a638a011877b7344b252f92276 to before 1d26a6e007d46babc7fa76e5a157dccf86cd55c0, 9b73896a81dc68a638a011877b7344b252f92276 to before b0e94ea63dbdcbfec9beb819cd5f8fa584809ef2, 9b73896a81dc68a638a011877b7344b252f92276 to before 21526f8a191a3c50622b8c10bd927870d780eae4, 9b73896a81dc68a638a011877b7344b252f92276 to before 292846223eaddba890e40699d2ab82ee5671798c, 9b73896a81dc68a638a011877b7344b252f92276 to before f392affef3c9ce64dfdde794df0579e0a7793440, 9b73896a81dc68a638a011877b7344b252f92276 to before b0346dd64e4905291cc9c479f2e6cf1884ced4e6
Linux

Linux · 4.9
Linux

Component: Not specified by the source
File: net/kcm/kcmsock.c

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

Published 19-Oct-2026 10:36 UTC

Product: azl3 kernel 6.6.150.1-1 on Azure Linux 3.0
CCR priority: 31.2 /100 (P4)
CVSS 3.1: 7.8 /10 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · Source advisory
EPSS: 0.00176 · percentile 0.06638 · 2026-10-17
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-18 12:55:59.341568+00:00 UTC
Microsoft MSRC Security Update Guide (CVRF) · Source record · observed 2026-10-04 07:08:49.022374+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-19 10:33:46.008150+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-90143.html