CVE-2026-74337
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks NMI and tracepoint BPF programs can re-enter the per-CPU or global LRU lock that bpf_lru_pop_free()/push_free() already hold on the same CPU, AA-deadlocking. Lockdep reports "inconsistent {INITIAL USE} -> {IN-NMI}" on &l->lock (syzbot c69a0a2c816716f1e0d5) and "possible recursive locking detected" on &loc_l->lock (syzbot 18b26edb69b2e19f3b33). Prior trylock and rqspinlock based fixes (see links) were nacked because compromised on reliability. This patch converts every LRU lock site to rqspinlock_t and adds a recovery path for some failure windows to avoid node leaks. Failure recovery: - *_pop_free top-level: return NULL; prealloc_lru_pop() already treats that as no-free-element (-ENOMEM). - Cross-CPU steal: skip the victim's locked loc_l, try next CPU. - Post-steal local lock fail: publish stolen node to lockless per-CPU free_llist; next pop on this CPU picks it up. - push_free fail: mark node pending_free=1. __local_list_flush(), __local_list_pop_pending() reclaim the node from pending_list. __bpf_lru_list_shrink_inactive() reclaims the node from inactive list. Nodes from active list are reclaimed by __bpf_lru_list_shrink() or after __bpf_lru_list_rotate_active() demotes it to the inactive.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74337
EUVD
EUVD-2026-59484

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a deadlock issue in BPF programs when using NMI or tracepoint functions. These programs can re-enter a per-CPU or global LRU lock that is already held, causing a deadlock. The issue arises because prior fixes compromised reliability. The patch converts LRU lock sites to rqspinlock_t and adds recovery paths to prevent node leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and requires kernel-level detection. Check if your kernel version is affected by running: uname -a. Compare the output with patched kernel versions. Look for lockdep warnings in kernel logs with: dmesg | grep -i "lockdep" or journalctl -k | grep -i "deadlock". If you see NMI or tracepoint-related deadlocks, the vulnerability may be present.

No direct commands detect this issue without kernel logs or lockdep warnings. Monitor system stability and check for kernel panics or hangs during BPF program execution.

Impact Analysis

This vulnerability could lead to system hangs or crashes due to deadlocks in BPF programs. It may cause kernel instability, disrupting services relying on BPF functionality. Systems using affected Linux kernel versions could experience performance degradation or unexpected failures.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for this vulnerability. Check your distribution's security advisories for patched kernels. If updating is not immediately possible, avoid using BPF programs that may trigger NMI or tracepoint re-entry until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74337. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart