CVE-2026-74354
Received Received - Intake

Linux Kernel mmap_lock Bypass in BPF

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Take mmap_lock in zap_pages() zap_vma_range() requires the owning mm's mmap_lock to be held. Taking mmap_read_lock under arena->lock would AB-BA against arena_vm_close() and arena_map_mmap(), both of which run with mmap_write_lock held and then acquire arena->lock. Instead drop arena->lock, mmget_not_zero() the vma's mm, take mmap_read_lock, and re-resolve the vma via find_vma() since it may have been unmapped or replaced while waiting. Track processed vmls with a per-call generation in vml->zap_gen and serialize zap_pages() callers with a new arena->zap_mutex so concurrent callers on different uaddr ranges do not mark each other's vmls processed before the zap is done.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74354
EUVD
EUVD-2026-59501

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a locking issue in the BPF (Berkeley Packet Filter) subsystem. The zap_vma_range() function requires the mmap_lock of the owning memory management structure to be held. The current implementation attempts to take mmap_read_lock while holding arena->lock, which can lead to a deadlock (AB-BA deadlock) against functions like arena_vm_close() and arena_map_mmap() that hold mmap_write_lock and then acquire arena->lock.

Detection Guidance

This vulnerability is specific to the Linux kernel and requires kernel-level detection. No direct commands are provided in the context to detect this issue. Monitoring kernel logs for crashes or unusual behavior related to BPF operations may indicate exploitation attempts.

Impact Analysis

This vulnerability could lead to system hangs or crashes due to deadlocks in the kernel. If exploited, it may cause denial-of-service conditions where the system becomes unresponsive. Users might experience system freezes or require a reboot to recover normal operation.

Mitigation Strategies

Update the Linux kernel to the latest patched version that resolves this issue. If immediate patching is not possible, restrict access to BPF functionality via kernel parameters or disable untrusted BPF programs until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74354. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart