CVE-2026-74344

Received Received - Intake

BPF rb_root Use-After-Free in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear rb node linkage when freeing bpf_rb_root bpf_rb_root_free() detaches the root by copying the current rb_root_cached and then replacing the live root with RB_ROOT_CACHED. It then walks the copied root and drops each object contained in the tree. This leaves the rb node state intact while dropping the object. If the object is refcounted and survives the drop, its bpf_rb_node_kern still contains an owner pointer to the freed root and stale rb tree linkage. If a later bpf_rb_root allocation reuses the same address, bpf_rbtree_remove() can incorrectly pass the owner check and call rb_erase_cached() on a node whose rb pointers belong to the old tree. Mirror the list draining behavior by marking nodes as busy while the root is being detached, then clear the rb node and release the owner before dropping the containing object. This makes surviving nodes unowned and safe to reject from remove or accept for a later add.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74344

EUVD

EUVD-2026-59491

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where bpf_rb_root_free() fails to properly clear rb node linkages when freeing memory. This leaves stale pointers and tree linkages that could cause incorrect operations if the memory is reused later.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation. Detection requires checking the kernel version and BPF-related components. Use commands like 'uname -r' to check the kernel version and 'lsmod | grep bpf' to verify BPF module status. If the kernel is vulnerable, update to a patched version immediately.

Impact Analysis

If exploited, this could lead to memory corruption, crashes, or privilege escalation in systems running vulnerable Linux kernels. It primarily affects BPF (Berkeley Packet Filter) functionality.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel memory management issue that could lead to undefined behavior in BPF (Berkeley Packet Filter) operations, potentially causing system instability or crashes. Compliance impacts would only occur if such instability disrupts data processing or security controls.

Mitigation Strategies

Update the Linux kernel to a version that includes the fix for this vulnerability. This typically involves running 'sudo apt update && sudo apt upgrade' for Debian-based systems or 'sudo yum update' for RHEL-based systems. Reboot the system after applying the update to ensure the patched kernel is active.

Hi! I’m here to help you understand CVE-2026-74344. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70