CVE-2026-74363
Received Received - Intake

BPF Use-After-Free in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning htab with internal structs") moved inode cleanup from ->free_inode() into ->destroy_inode() to avoid sleeping in RCU context when calling bpf_any_put(). However this removed the RCU delay on freeing the inode itself and the cached symlink body (i_link), both of which can be accessed by RCU pathwalk (pick_link, may_lookup etc.). This causes a use-after-free when a concurrent unlinkat() drops the last inode reference and destroy_inode() frees the inode immediately, while another task is still walking the path in RCU mode and reads inode->i_opflags (offset +2) inside current_time() -> is_mgtime(). KASAN reports: BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313 Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags) The rules (per Al Viro): ->destroy_inode() called immediately, can sleep, use for blocking cleanup e.g. bpf_any_put() ->free_inode() called after RCU grace period, use for freeing inode and anything RCU-accessible e.g. i_link Fix: split the two concerns properly: - keep bpf_any_put() in bpf_destroy_inode() since it is blocking and needs to run promptly - introduce bpf_free_inode() to handle kfree(i_link) and free_inode_nonrcu() with proper RCU delay, preventing the UAF

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74363
EUVD
EUVD-2026-59510

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's BPF filesystem (bpffs). It occurs when an inode is freed immediately during cleanup instead of after an RCU grace period, allowing concurrent pathwalk operations to access freed memory. The issue stems from moving inode cleanup to destroy_inode() which doesn't delay freeing, causing crashes when i_opflags are read during RCU pathwalk.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF filesystem (bpffs) and requires kernel-level detection. Check kernel logs for KASAN reports indicating slab-use-after-free in is_mgtime or related BPF operations. Use commands like dmesg | grep -i kasan or journalctl -k | grep -i use-after-free to identify crashes. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability can cause system crashes or instability when the Linux kernel is running BPF programs. Attackers could potentially trigger the UAF to execute arbitrary code or escalate privileges. Systems using bpffs for BPF program management are most affected.

Mitigation Strategies

Update the Linux kernel to a version containing the fix (commit 4f375ade6aa9 or later). If immediate patching is not possible, disable BPF filesystem features or restrict unprivileged BPF usage. Monitor for crashes or KASAN errors in logs. Apply vendor-supplied kernel updates promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74363. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart