« Volver al listado

CVE-2026-74400

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries

bpf_set_dentry_xattr and bpf_remove_dentry_xattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passed (e.g. from security_inode_create), d_inode(dentry) returns NULL, and inode_lock(inode) will cause a NULL pointer dereference.

Trivially fix this by adding a NULL check for inode before attempting to lock it, returning -EINVAL if it is NULL.

Additionally, drop WARN_ON(!inode) in bpf_xattr_read_permission() and bpf_xattr_write_permission().

Leer descripción completaMostrar menos

These warnings could be triggered by passing a negative dentry to bpf_get_dentry_xattr() or the _locked variants of the xattr kfuncs, potentially causing a Denial of Service on systems with panic_on_warn enabled. Instead, simply return -EINVAL.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-74400",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "56467292794b800164df20c076c409ac548e56ec",
              "lessThan": "e003f3a4be738f650e283e92d07017c3fef8da52",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "56467292794b800164df20c076c409ac548e56ec",
              "lessThan": "0160edf2af51c5fde742973742c5d10497901b21",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "56467292794b800164df20c076c409ac548e56ec",
              "lessThan": "07410646f6ff1d23222f105ccab778957d401bbe",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/bpf_fs_kfuncs.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.15",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/bpf_fs_kfuncs.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:22:42.030",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0160edf2af51c5fde742973742c5d10497901b21",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/07410646f6ff1d23222f105ccab778957d401bbe",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e003f3a4be738f650e283e92d07017c3fef8da52",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries\n\nbpf_set_dentry_xattr and bpf_remove_dentry_xattr BPF kfuncs attempt to\nlock the inode of the supplied dentry without checking if it is\nNULL. If a negative dentry is passed (e.g. from\nsecurity_inode_create), d_inode(dentry) returns NULL, and\ninode_lock(inode) will cause a NULL pointer dereference.\n\nTrivially fix this by adding a NULL check for inode before attempting\nto lock it, returning -EINVAL if it is NULL.\n\nAdditionally, drop WARN_ON(!inode) in bpf_xattr_read_permission() and\nbpf_xattr_write_permission(). These warnings could be triggered by\npassing a negative dentry to bpf_get_dentry_xattr() or the _locked\nvariants of the xattr kfuncs, potentially causing a Denial of Service\non systems with panic_on_warn enabled. Instead, simply return -EINVAL."
    }
  ],
  "lastModified": "2026-08-17T06:19:35.183",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}