CVE-2026-74371
Received Received - Intake

Out-of-Bounds Write in Linux Kernel BPF Subsystem

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat BPF_PROG_QUERY writes back the 'query.revision' field unconditionally to userspace. If userspace passes a smaller 'bpf_attr' structure (e.g. 40 bytes, which was the layout before the addition of 'query.revision'), the kernel performs an out-of-bounds write. Fix this by propagating the user-provided attribute size 'uattr_size' down to the cgroup query handlers, and conditionally skipping writing the revision field to userspace when the provided buffer size is insufficient. query.revision in bpf_mprog_query is structurally identical to the cgroup case: a late tail field, written unconditionally. But the backward-compat hazard is not the same. The min-historical-size test is per command, and bpf_mprog_query only serves attach types that were born with revision in the struct: - tcx_prog_query -> BPF_TCX_INGRESS/EGRESS - netkit_prog_query -> BPF_NETKIT_PRIMARY/PEER tcx, netkit, the revision field, and bpf_mprog_query itself all landed in the same v6.6 merge window (053c8e1f235d added the mprog query API + revision; tcx in e420bed02507, netkit in 35dfaad7188c). There has never been a tcx/netkit BPF_PROG_QUERY userspace that doesn't know about revision. So for these commands the minimum legitimate struct already covers offset 56-64 — no old binary can be broken here. Contrast with cgroup: BPF_PROG_QUERY on cgroup attach types shipped in 2017; revision write-back was bolted on years later (120933984460). That path has a real population of pre-revision callers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74371
EUVD
EUVD-2026-59518

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves an out-of-bounds (OOB) write issue in the BPF_PROG_QUERY operation. The kernel unconditionally writes the 'query.revision' field to userspace, which can cause memory corruption if userspace provides a smaller buffer than expected. The fix ensures the kernel checks the user-provided buffer size before writing the revision field.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF subsystem and requires kernel-level inspection. Detection involves checking kernel version and BPF-related components. Use commands like 'uname -a' to check kernel version and 'dmesg | grep BPF' to look for BPF-related errors. Monitor for crashes or unexpected behavior in BPF-related applications.

Impact Analysis

This vulnerability could allow an attacker with local access to cause memory corruption, potentially leading to system crashes, privilege escalation, or other unintended behavior. It primarily affects systems using BPF_PROG_QUERY with cgroup attach types, as older binaries may not account for the revision field.

Mitigation Strategies

Apply the latest kernel security patches immediately. Update to a kernel version that includes the fix for CVE-2026-74371. If patching is not immediately possible, consider disabling BPF functionality temporarily if it is not critical to operations. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74371. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart