CVE-2026-74305

Received Received - Intake

BPF cgroup storage cookie validation bypass

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 ("bpf: Fix oob access in cgroup local storage") is still incomplete. The prog-array compatibility check treats a program with no cgroup storage as compatible with any stored storage cookie. This allows a storage-less program to bridge a tail call chain between an entry program and a storage-using callee even though cgroup local storage at runtime still follows the caller's context, that is, A -> B(no storage) -> C(storage) path. Requiring exact cookie equality would break the legitimate case of a storage-less leaf program being tail called from a storage-using one. Instead, only accept a zero storage cookie if the program cannot perform tail calls itself. This keeps A -> B(no storage) working while rejecting the A -> B(no storage) -> C(storage) bridge.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74305

EUVD

EUVD-2026-59452

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the BPF (Berkeley Packet Filter) subsystem related to cgroup storage cookie checks for program arrays. The issue allows a storage-less program to bridge a tail call chain between an entry program and a storage-using program, bypassing intended security checks. The fix ensures only programs that cannot perform tail calls themselves can have a zero storage cookie, preventing unauthorized access while maintaining legitimate functionality.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and requires kernel-level inspection. Detection involves checking kernel version and BPF-related configurations. Use commands like 'uname -r' to check kernel version and 'lsmod | grep bpf' to verify BPF module status. Inspect BPF program configurations with 'bpftool prog show' if available.

Impact Analysis

This vulnerability could allow an attacker to bypass security mechanisms in the Linux kernel by exploiting improper cgroup storage cookie checks. This might lead to unauthorized access or execution of malicious code, potentially compromising system integrity or confidentiality. Systems using BPF programs with cgroup storage are most at risk.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a technical flaw in the Linux kernel's BPF subsystem. Compliance impacts would depend on how the vulnerability is exploited in a specific system or environment.

Mitigation Strategies

Apply the kernel patch referenced in the CVE description (commit abad3d0bad72). Update to a patched kernel version if available. Restrict unprivileged BPF usage via kernel parameters like 'kernel.unprivileged_bpf_disabled=1'. Monitor BPF program behavior for unexpected tail calls between storage and non-storage contexts.

Hi! I’m here to help you understand CVE-2026-74305. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70