CVE-2026-74314

Received Received - Intake

BPF Special Field Cancellation on Map Value Recycle

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpf_obj_free_fields() when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete operation. For tracing programs this can include NMI context, where referenced kptr destructors, uptr unpinning, and graph root destruction are not generally safe. Introduce bpf_obj_cancel_fields() for the reusable-value path. It only performs NMI-safe cleanup for timer, workqueue, and task_work fields. Fields that need full destruction are left attached to the recycled value and are destroyed by the final cleanup path instead. Switch array and hashtab update/delete/recycle paths to this cancel helper. Keep bpf_obj_free_fields() for final map destruction and for bpf_mem_alloc destructors. Preallocated hashtabs do not have allocator destructors, so teardown continues to walk the normal and extra elements and fully destroy their fields. This deliberately relaxes the eager-free semantics of map update/delete for special fields. Programs that relied on a recycled map slot becoming empty immediately after update/delete were relying on behavior that cannot be implemented safely from every BPF execution context without offloading arbitrary destructors. There is a chance this change breaks programs making assumptions regarding the eager freeing of fields. If so, we can relax semantics to cancellation only when irqs_disabled() is true in the future. However, theoretically, map values that get reused eagerly already have weaker guarantees as parallel users can recreate freed fields before the new element becomes visible again.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74314

EUVD

EUVD-2026-59461

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves unsafe cleanup of special fields during BPF map value recycling. The issue occurs when map updates or deletions call field destruction functions that may include unsafe operations like kptr destructor calls or uptr unpinning in NMI (Non-Maskable Interrupt) context. A new function, bpf_obj_cancel_fields(), was introduced to handle only NMI-safe cleanup for specific fields, while deferring full destruction to later stages.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and requires kernel-level inspection. Detection involves checking kernel logs for BPF-related errors or crashes, particularly during map operations. Commands like dmesg, journalctl -k, or checking /var/log/kern.log may reveal issues. No direct network detection commands are applicable.

Impact Analysis

This vulnerability may impact systems running the Linux kernel with BPF (Berkeley Packet Filter) functionality. It could lead to kernel instability or crashes if BPF programs rely on immediate cleanup of map values during updates or deletions. Programs assuming fields are eagerly freed may break, potentially causing unexpected behavior or security issues.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel BPF subsystem issue involving unsafe field destruction in NMI context, which could lead to memory corruption or crashes but does not inherently violate data protection or privacy regulations.

Mitigation Strategies

Update your Linux kernel to the patched version that includes the fix for CVE-2026-74314. If immediate patching is not possible, avoid using BPF programs that interact with map values until the update is applied. Monitor kernel logs for BPF-related errors as a potential sign of exploitation.

Hi! I’m here to help you understand CVE-2026-74314. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70