CVE-2026-74314

Estado: RecibidaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

bpf: Cancel special fields on map value recycle

Map update and delete paths currently call bpf_obj_free_fields() when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete operation. For tracing programs this can include NMI context, where referenced kptr destructors, uptr unpinning, and graph root destruction are not generally safe.

Introduce bpf_obj_cancel_fields() for the reusable-value path. It only performs NMI-safe cleanup for timer, workqueue, and task_work fields. Fields that need full destruction are left attached to the recycled value and are destroyed by the final cleanup path instead.

Leer descripción completaMostrar menos

Switch array and hashtab update/delete/recycle paths to this cancel helper. Keep bpf_obj_free_fields() for final map destruction and for bpf_mem_alloc destructors. Preallocated hashtabs do not have allocator destructors, so teardown continues to walk the normal and extra elements and fully destroy their fields.

This deliberately relaxes the eager-free semantics of map update/delete for special fields. Programs that relied on a recycled map slot becoming empty immediately after update/delete were relying on behavior that cannot be implemented safely from every BPF execution context without offloading arbitrary destructors.

There is a chance this change breaks programs making assumptions regarding the eager freeing of fields. If so, we can relax semantics to cancellation only when irqs_disabled() is true in the future. However, theoretically, map values that get reused eagerly already have weaker guarantees as parallel users can recreate freed fields before the new element becomes visible again.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.18%
Percentil entre todas las CVEs puntuadas: 7
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation75 %
Impacto principalT1059 Command and Scripting Interpreterexecution65 %
Impacto secundarioT1499.004 Application or System Exploitationimpact55 %

Acceso local (AV:L) con PR:L sin interacción → T1068. Ejecución de código en kernel BPF tras escalada. DoS potencial por manejo inseguro en contexto NMI.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution Prevention Threat Intelligence Program Restrict Web-Based Content Privileged Account Management Limit Software Installation Filter Network Traffic

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-74314",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "14a324f6a67ef6a53e04362a70160a47eb8afffa",
              "lessThan": "9ea734e2cc0143d7429ab7dc0b20c85e5836183c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "14a324f6a67ef6a53e04362a70160a47eb8afffa",
              "lessThan": "a3a81d247651218e47153f2d2afd7aee236726fd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f0462d38589422bc9e27fd3c6343dfeb6b3db2f9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5.18.18",
              "lessThan": "5.19",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/arraymap.c",
            "kernel/bpf/hashtab.c",
            "kernel/bpf/syscall.c",
            "tools/testing/selftests/bpf/prog_tests/htab_update.c",
            "tools/testing/selftests/bpf/prog_tests/linked_list.c",
            "tools/testing/selftests/bpf/prog_tests/map_kptr.c",
            "tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c",
            "tools/testing/selftests/bpf/progs/htab_update.c",
            "tools/testing/selftests/bpf/progs/linked_list.c",
            "tools/testing/selftests/bpf/progs/refcounted_kptr.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.19",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/arraymap.c",
            "kernel/bpf/hashtab.c",
            "kernel/bpf/syscall.c",
            "tools/testing/selftests/bpf/prog_tests/htab_update.c",
            "tools/testing/selftests/bpf/prog_tests/linked_list.c",
            "tools/testing/selftests/bpf/prog_tests/map_kptr.c",
            "tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c",
            "tools/testing/selftests/bpf/progs/htab_update.c",
            "tools/testing/selftests/bpf/progs/linked_list.c",
            "tools/testing/selftests/bpf/progs/refcounted_kptr.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:22:31.617",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/9ea734e2cc0143d7429ab7dc0b20c85e5836183c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a3a81d247651218e47153f2d2afd7aee236726fd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Cancel special fields on map value recycle\n\nMap update and delete paths currently call bpf_obj_free_fields() when a\nvalue is being replaced or recycled. That makes field destruction depend\non the context of the update/delete operation. For tracing programs this\ncan include NMI context, where referenced kptr destructors, uptr\nunpinning, and graph root destruction are not generally safe.\n\nIntroduce bpf_obj_cancel_fields() for the reusable-value path. It only\nperforms NMI-safe cleanup for timer, workqueue, and task_work fields.\nFields that need full destruction are left attached to the recycled value\nand are destroyed by the final cleanup path instead.\n\nSwitch array and hashtab update/delete/recycle paths to this cancel\nhelper. Keep bpf_obj_free_fields() for final map destruction and for\nbpf_mem_alloc destructors. Preallocated hashtabs do not have allocator\ndestructors, so teardown continues to walk the normal and extra elements\nand fully destroy their fields.\n\nThis deliberately relaxes the eager-free semantics of map update/delete\nfor special fields. Programs that relied on a recycled map slot becoming\nempty immediately after update/delete were relying on behavior that\ncannot be implemented safely from every BPF execution context without\noffloading arbitrary destructors.\n\nThere is a chance this change breaks programs making assumptions\nregarding the eager freeing of fields. If so, we can relax semantics to\ncancellation only when irqs_disabled() is true in the future. However,\ntheoretically, map values that get reused eagerly already have weaker\nguarantees as parallel users can recreate freed fields before the new\nelement becomes visible again."
    }
  ],
  "lastModified": "2026-08-17T06:19:25.733",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}