CVE-2026-74400
Received Received - Intake

BPF Kernel NULL Pointer Dereference in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries bpf_set_dentry_xattr and bpf_remove_dentry_xattr BPF kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative dentry is passed (e.g. from security_inode_create), d_inode(dentry) returns NULL, and inode_lock(inode) will cause a NULL pointer dereference. Trivially fix this by adding a NULL check for inode before attempting to lock it, returning -EINVAL if it is NULL. Additionally, drop WARN_ON(!inode) in bpf_xattr_read_permission() and bpf_xattr_write_permission(). These warnings could be triggered by passing a negative dentry to bpf_get_dentry_xattr() or the _locked variants of the xattr kfuncs, potentially causing a Denial of Service on systems with panic_on_warn enabled. Instead, simply return -EINVAL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74400
EUVD
EUVD-2026-59547

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference flaw in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. It occurs when the bpf_set_dentry_xattr or bpf_remove_dentry_xattr functions attempt to lock an inode without checking if the dentry is negative (i.e., does not point to an inode). Passing a negative dentry causes d_inode(dentry) to return NULL, leading to a crash when inode_lock(inode) is called.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and requires kernel-level inspection. Detection involves checking the kernel version and BPF-related logs or crashes. Use commands like 'uname -a' to check the kernel version and 'dmesg | grep -i bpf' to look for BPF-related errors or crashes.

Impact Analysis

This vulnerability can cause a kernel crash (NULL pointer dereference) when specific BPF operations are performed on negative dentries. This may lead to system instability, denial of service, or potential privilege escalation if exploited. Systems with panic_on_warn enabled could experience a kernel panic.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch this vulnerability. If immediate patching is not possible, consider disabling BPF-related features or restricting access to BPF functionality until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74400. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart