{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74314", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.883Z", "datePublished": "2026-08-15T05:58:12.766Z", "dateUpdated": "2026-10-16T18:55:32.490Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:45:47.130Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Cancel special fields on map value recycle\n\nMap update and delete paths currently call bpf_obj_free_fields() when a\nvalue is being replaced or recycled. That makes field destruction depend\non the context of the update/delete operation. For tracing programs this\ncan include NMI context, where referenced kptr destructors, uptr\nunpinning, and graph root destruction are not generally safe.\n\nIntroduce bpf_obj_cancel_fields() for the reusable-value path. It only\nperforms NMI-safe cleanup for timer, workqueue, and task_work fields.\nFields that need full destruction are left attached to the recycled value\nand are destroyed by the final cleanup path instead.\n\nSwitch array and hashtab update/delete/recycle paths to this cancel\nhelper. Keep bpf_obj_free_fields() for final map destruction and for\nbpf_mem_alloc destructors. Preallocated hashtabs do not have allocator\ndestructors, so teardown continues to walk the normal and extra elements\nand fully destroy their fields.\n\nThis deliberately relaxes the eager-free semantics of map update/delete\nfor special fields. Programs that relied on a recycled map slot becoming\nempty immediately after update/delete were relying on behavior that\ncannot be implemented safely from every BPF execution context without\noffloading arbitrary destructors.\n\nThere is a chance this change breaks programs making assumptions\nregarding the eager freeing of fields. If so, we can relax semantics to\ncancellation only when irqs_disabled() is true in the future. However,\ntheoretically, map values that get reused eagerly already have weaker\nguarantees as parallel users can recreate freed fields before the new\nelement becomes visible again."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached via bpf_map_update_elem/delete_elem on BPF array/hash maps, callable from the bpf() syscall and from in-kernel BPF helpers when tracing or perf BPF programs run; per kernel guidance BPF is a Local attack vector, not network-reachable.\nAC:L - An attacker who can load and attach BPF programs controls the map contents, update/delete timing, and trace/perf attach points (including NMI-capable hooks), so the unsafe bpf_obj_free_fields() recycle path is triggerable without luck or victim-specific state.\nPR:L - Exploitation requires loading tracing/perf BPF programs with BTF maps holding kptr/list/uptr fields (CAP_BPF plus CAP_PERFMON), which bpf_token_capable() grants to user-namespace CAP_SYS_ADMIN holders (e.g. unshare -Urn) and delegated BPF token users, not only init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers map recycle from their own loaded BPF program or concurrent bpf() map operations during tracing/perf events they control.\nS:U - Impact stays within kernel memory and privilege boundaries (deadlock, oops, memory corruption, potential local privilege escalation) and does not cross VM, container, or IOMMU security scopes on its own.\nC:H - Recycling map values from NMI/atomic tracing context runs bpf_obj_free_fields() kptr destructors, uptr unpinning, and graph teardown unsafely, enabling use-after-free and inconsistent object lifetimes that can be turned into arbitrary kernel memory disclosure.\nI:H - The same unsafe recycle path performs non-NMI-safe kptr destructor calls, recursive __bpf_obj_drop_impl() graph freeing, and uptr unpinning from wrong context, giving plausible heap corruption and control-flow hijack primitives beyond a simple crash.\nA:H - Calling bpf_obj_free_fields() from NMI/tracing contexts can deadlock on BPF/hash locks (documented IN-NMI lockdep failures in related BPF LRU fixes) or panic/oops via illegal page unpinning and destructor execution, fully denying kernel availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/bpf.h", "kernel/bpf/arraymap.c", "kernel/bpf/hashtab.c", "kernel/bpf/syscall.c", "tools/testing/selftests/bpf/prog_tests/htab_update.c", "tools/testing/selftests/bpf/prog_tests/linked_list.c", "tools/testing/selftests/bpf/prog_tests/map_kptr.c", "tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c", "tools/testing/selftests/bpf/progs/htab_update.c", "tools/testing/selftests/bpf/progs/linked_list.c", "tools/testing/selftests/bpf/progs/refcounted_kptr.c"], "versions": [{"version": "14a324f6a67ef6a53e04362a70160a47eb8afffa", "lessThan": "9ea734e2cc0143d7429ab7dc0b20c85e5836183c", "status": "affected", "versionType": "git"}, {"version": "14a324f6a67ef6a53e04362a70160a47eb8afffa", "lessThan": "a3a81d247651218e47153f2d2afd7aee236726fd", "status": "affected", "versionType": "git"}, {"version": "f0462d38589422bc9e27fd3c6343dfeb6b3db2f9", "status": "affected", "versionType": "git"}, {"version": "5.18.18", "lessThan": "5.19", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/bpf.h", "kernel/bpf/arraymap.c", "kernel/bpf/hashtab.c", "kernel/bpf/syscall.c", "tools/testing/selftests/bpf/prog_tests/htab_update.c", "tools/testing/selftests/bpf/prog_tests/linked_list.c", "tools/testing/selftests/bpf/prog_tests/map_kptr.c", "tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c", "tools/testing/selftests/bpf/progs/htab_update.c", "tools/testing/selftests/bpf/progs/linked_list.c", "tools/testing/selftests/bpf/progs/refcounted_kptr.c"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9ea734e2cc0143d7429ab7dc0b20c85e5836183c"}, {"url": "https://git.kernel.org/stable/c/a3a81d247651218e47153f2d2afd7aee236726fd"}], "title": "bpf: Cancel special fields on map value recycle", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74314", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:53:09.033904Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:32.490Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/bpf.h", "kernel/bpf/arraymap.c", "kernel/bpf/hashtab.c", "kernel/bpf/syscall.c", "tools/testing/selftests/bpf/prog_tests/htab_update.c", "tools/testing/selftests/bpf/prog_tests/linked_list.c", "tools/testing/selftests/bpf/prog_tests/map_kptr.c", "tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c", "tools/testing/selftests/bpf/progs/htab_update.c", "tools/testing/selftests/bpf/progs/linked_list.c", "tools/testing/selftests/bpf/progs/refcounted_kptr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9ea734e2cc0143d7429ab7dc0b20c85e5836183c", "status": "affected", "version": "14a324f6a67ef6a53e04362a70160a47eb8afffa", "versionType": "git"}, {"lessThan": "a3a81d247651218e47153f2d2afd7aee236726fd", "status": "affected", "version": "14a324f6a67ef6a53e04362a70160a47eb8afffa", "versionType": "git"}, {"status": "affected", "version": "f0462d38589422bc9e27fd3c6343dfeb6b3db2f9", "versionType": "git"}, {"lessThan": "5.19", "status": "affected", "version": "5.18.18", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/bpf.h", "kernel/bpf/arraymap.c", "kernel/bpf/hashtab.c", "kernel/bpf/syscall.c", "tools/testing/selftests/bpf/prog_tests/htab_update.c", "tools/testing/selftests/bpf/prog_tests/linked_list.c", "tools/testing/selftests/bpf/prog_tests/map_kptr.c", "tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c", "tools/testing/selftests/bpf/progs/htab_update.c", "tools/testing/selftests/bpf/progs/linked_list.c", "tools/testing/selftests/bpf/progs/refcounted_kptr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Cancel special fields on map value recycle\n\nMap update and delete paths currently call bpf_obj_free_fields() when a\nvalue is being replaced or recycled. That makes field destruction depend\non the context of the update/delete operation. For tracing programs this\ncan include NMI context, where referenced kptr destructors, uptr\nunpinning, and graph root destruction are not generally safe.\n\nIntroduce bpf_obj_cancel_fields() for the reusable-value path. It only\nperforms NMI-safe cleanup for timer, workqueue, and task_work fields.\nFields that need full destruction are left attached to the recycled value\nand are destroyed by the final cleanup path instead.\n\nSwitch array and hashtab update/delete/recycle paths to this cancel\nhelper. Keep bpf_obj_free_fields() for final map destruction and for\nbpf_mem_alloc destructors. Preallocated hashtabs do not have allocator\ndestructors, so teardown continues to walk the normal and extra elements\nand fully destroy their fields.\n\nThis deliberately relaxes the eager-free semantics of map update/delete\nfor special fields. Programs that relied on a recycled map slot becoming\nempty immediately after update/delete were relying on behavior that\ncannot be implemented safely from every BPF execution context without\noffloading arbitrary destructors.\n\nThere is a chance this change breaks programs making assumptions\nregarding the eager freeing of fields. If so, we can relax semantics to\ncancellation only when irqs_disabled() is true in the future. However,\ntheoretically, map values that get reused eagerly already have weaker\nguarantees as parallel users can recreate freed fields before the new\nelement becomes visible again."}], "id": "CVE-2026-74314", "lastModified": "2026-10-16T19:17:38.840", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74314", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:53:09.033904Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:31.617", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9ea734e2cc0143d7429ab7dc0b20c85e5836183c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a3a81d247651218e47153f2d2afd7aee236726fd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: Cancel special fields on map value recycle", "id": "2516759", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516759"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-763", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Cancel special fields on map value recycle\nMap update and delete paths currently call bpf_obj_free_fields() when a\nvalue is being replaced or recycled. That makes field destruction depend\non the context of the update/delete operation. For tracing programs this\ncan include NMI context, where referenced kptr destructors, uptr\nunpinning, and graph root destruction are not generally safe.\nIntroduce bpf_obj_cancel_fields() for the reusable-value path. It only\nperforms NMI-safe cleanup for timer, workqueue, and task_work fields.\nFields that need full destruction are left attached to the recycled value\nand are destroyed by the final cleanup path instead.\nSwitch array and hashtab update/delete/recycle paths to this cancel\nhelper. Keep bpf_obj_free_fields() for final map destruction and for\nbpf_mem_alloc destructors. Preallocated hashtabs do not have allocator\ndestructors, so teardown continues to walk the normal and extra elements\nand fully destroy their fields.\nThis deliberately relaxes the eager-free semantics of map update/delete\nfor special fields. Programs that relied on a recycled map slot becoming\nempty immediately after update/delete were relying on behavior that\ncannot be implemented safely from every BPF execution context without\noffloading arbitrary destructors.\nThere is a chance this change breaks programs making assumptions\nregarding the eager freeing of fields. If so, we can relax semantics to\ncancellation only when irqs_disabled() is true in the future. However,\ntheoretically, map values that get reused eagerly already have weaker\nguarantees as parallel users can recreate freed fields before the new\nelement becomes visible again.", "A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. This vulnerability arises from improper handling of special fields during the recycling of map values, which can lead to unsafe destruction operations. Specifically, in tracing programs operating within a Non-Maskable Interrupt (NMI) context, this resource management issue could result in unexpected system behavior or data integrity problems."], "name": "CVE-2026-74314", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74314\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74314\nhttps://lore.kernel.org/linux-cve-announce/2026081552-CVE-2026-74314-fc58@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[14a324f6a67ef6a53e04362a70160a47eb8afffa,9ea734e2cc0143d7429ab7dc0b20c85e5836183c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[14a324f6a67ef6a53e04362a70160a47eb8afffa,a3a81d247651218e47153f2d2afd7aee236726fd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "f0462d38589422bc9e27fd3c6343dfeb6b3db2f9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.18.18,5.19)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T16:45:10.769850+00:00", "updated": "2026-08-22T02:45:03.715218+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}