CVE-2026-74360

Received Received - Intake

BPF Map Iterator Write Access in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps for bpf_map_elem iterators Exclusive maps (aka excl_prog_hash) are meant to be reachable only from the single program whose hash matches. This is enforced by check_map_prog_compatibility() when the map is referenced from a program such as signed BPF loaders. A bpf_map_elem iterator, however, binds its target map at attach time in bpf_iter_attach_map() instead of referencing it from the program, so the exclusivity check is never reached. On top of that, the iterator exposes the map value as a writable buffer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74360

EUVD

EUVD-2026-59507

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves BPF map iterators bypassing exclusivity checks. Exclusive maps are designed to be accessible only by a single program, but BPF map element iterators attach to maps at runtime without referencing them from a program. This allows the iterator to expose the map value as a writable buffer, potentially enabling unauthorized access or modification.

Detection Guidance

This vulnerability affects the Linux kernel's BPF (Berkeley Packet Filter) subsystem, specifically related to exclusive maps and bpf_map_elem iterators. Detection requires checking kernel logs for BPF-related errors or examining kernel configurations. Commands like 'dmesg | grep -i bpf' or 'journalctl -k | grep -i bpf' may reveal relevant errors. Ensure your kernel version is up-to-date to confirm if the fix is applied.

Impact Analysis

This vulnerability could allow an attacker with access to BPF iterators to modify sensitive data in exclusive maps, leading to privilege escalation, data corruption, or unauthorized system access. Systems using BPF features may be at risk if attackers exploit this to manipulate kernel data structures.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards. It involves a flaw in the Linux kernel's BPF (Berkeley Packet Filter) subsystem where exclusive maps are not properly enforced for bpf_map_elem iterators, potentially allowing unauthorized access to writable map values. However, no evidence suggests this directly affects data protection or privacy regulations.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for CVE-2026-74360. Disable BPF iterators if not required by unloading related modules (e.g., 'rmmod bpf_iter'). Restrict access to BPF functionality via kernel parameters or seccomp profiles. Monitor kernel logs for suspicious activity post-update.

Hi! I’m here to help you understand CVE-2026-74360. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70