CVE-2026-74364

Received Received - Intake

BPF Map-in-Map Exploit via Exclusive Inner Maps

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map (created with excl_prog_hash) is bound to a single program by hash: check_map_prog_compatibility() refuses to load any program whose digest does not match map->excl_prog_sha. That check only runs for maps a program references directly, i.e. its used_maps. A map reached at runtime through a map-of-maps is never in used_maps, and bpf_map_meta_equal() does not consider excl_prog_sha, so an exclusive map can be inserted into a non-exclusive outer map and then looked up and mutated by an unrelated program, bypassing the exclusivity guarantee. For the signed loader this defeats the metadata map exclusivity check added in the signed loader: the cached map->sha[] is validated against the signed hash while another program on a hostile host rewrites the frozen map's contents through the outer map.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74364

EUVD

EUVD-2026-59511

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves exclusive BPF maps being incorrectly used as inner maps in map-in-map structures. Exclusive maps are designed to be bound to a single program, but due to missing checks, they can be inserted into non-exclusive outer maps. This allows unrelated programs to access and modify the exclusive map, bypassing security guarantees.

Detection Guidance

This vulnerability requires kernel-level inspection to detect. Check if your Linux kernel version includes the fix for CVE-2026-74364 by running: uname -r. Compare the version against patched releases. Inspect BPF map configurations with bpftool map list to identify exclusive maps used as inner maps in map-in-map structures.

Impact Analysis

If exploited, this flaw could allow an attacker to bypass program exclusivity checks in the Linux kernel's BPF subsystem. This might enable unauthorized access to sensitive data or execution of unintended code, potentially leading to system compromise or privilege escalation.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a low-level Linux kernel security flaw in BPF (Berkeley Packet Filter) map handling. Compliance implications would depend on how the affected system is used in a specific environment.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves CVE-2026-74364. Monitor vendor advisories for kernel updates and apply them promptly to ensure exclusivity checks in BPF maps are enforced correctly.

Hi! I’m here to help you understand CVE-2026-74364. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70