CVE-2026-74335
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_task_from_vpid() bpf_task_from_vpid() looks up a task in the pid namespace of the current task, via find_task_by_vpid(): find_task_by_vpid(vpid) find_task_by_pid_ns(vpid, task_active_pid_ns(current)) find_pid_ns(nr, ns) -> idr_find(&ns->idr, nr) cgroup_skb programs run in softirq, which may interrupt a task that is itself in do_exit(). Once that task has passed exit_notify() -> release_task() -> __unhash_process(), its thread_pid is cleared, so task_active_pid_ns(current) returns NULL and find_pid_ns() dereferences &NULL->idr: BUG: kernel NULL pointer dereference, address: 0000000000000050 RIP: 0010:idr_find+0x11/0x30 lib/idr.c:176 Call Trace: <IRQ> find_pid_ns kernel/pid.c:370 [inline] find_task_by_pid_ns+0x3b/0xe0 kernel/pid.c:485 bpf_task_from_vpid+0x5b/0x200 kernel/bpf/helpers.c:2916 bpf_prog_run_array_cg+0x17e/0x530 kernel/bpf/cgroup.c:81 __cgroup_bpf_run_filter_skb+0x12b/0x250 kernel/bpf/cgroup.c:1612 sk_filter_trim_cap+0x1dc/0x4c0 net/core/filter.c:148 tcp_v4_rcv+0x18d1/0x2200 net/ipv4/tcp_ipv4.c:2223 </IRQ> <TASK> do_exit+0xa63/0x1270 kernel/exit.c:1010 get_signal+0x141c/0x1530 kernel/signal.c:3037 Bail out when current has no pid namespace.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74335
EUVD
EUVD-2026-59482

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. It occurs in the bpf_task_from_vpid() function when handling cgroup_skb programs running in softirq context. The issue arises when a task is exiting and its thread_pid is cleared, causing task_active_pid_ns(current) to return NULL. This NULL value is then dereferenced in find_pid_ns(), leading to a kernel crash.

Detection Guidance

This vulnerability involves a NULL pointer dereference in the Linux kernel's BPF subsystem. Detection requires checking kernel logs for NULL pointer dereference errors related to idr_find or bpf_task_from_vpid. Monitor system logs for kernel oops or crashes, particularly during BPF program execution or network traffic processing.

Impact Analysis

This vulnerability can cause a kernel panic or system crash, leading to denial of service. Attackers could exploit it to trigger system instability or reboot systems remotely if they can trigger cgroup_skb programs with specific BPF operations.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution. If patches are unavailable, consider disabling BPF cgroup programs temporarily. Monitor kernel logs for signs of exploitation and restrict untrusted users from loading BPF programs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74335. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart