{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74258","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.877Z","datePublished":"2026-08-15T05:57:36.257Z","dateUpdated":"2026-08-17T05:45:07.606Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:45:07.606Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard __get_user acesss with access_ok for uprobe_multi data\n\nAs reported by sashiko [1] we need to use access_ok to check the user\nspace data bounds before we use __get-user to get it.\n\n[1] https://lore.kernel.org/bpf/20260610145235.CB1441F00893@smtp.kernel.org/"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in bpf_uprobe_multi_link_attach(), reached only via the local bpf(BPF_LINK_CREATE) syscall with BPF_TRACE_UPROBE_MULTI; per kernel CNA guidance BPF/uprobe link creation is Local, not network-reachable.\nAC:L - The attacker fully controls link_create.uprobe_multi offsets/ref_ctr_offsets/cookies pointers and cnt, so __get_user runs on attacker-chosen addresses without races or external conditions; repeated attempts reliably leak or fault.\nPR:L - Exploitation requires a BPF_PROG_TYPE_KPROBE program (CAP_BPF+CAP_PERFMON), routinely delegated via BPF tokens into non-init user namespaces for tracing/container workloads; this is low privilege, not init-namespace root.\nUI:N - No victim interaction is needed; the attacker loads the BPF program, issues BPF_LINK_CREATE with crafted pointers, and can read leaked data back via BPF_OBJ_GET_INFO_BY_FD on their own link.\nS:U - Impact is arbitrary kernel memory disclosure and possible host compromise within the same kernel security authority; it does not cross VM, IOMMU, or container sandbox boundaries by itself.\nC:H - Missing access_ok lets __get_user copy from kernel addresses into uprobes arrays (up to cnt*8 bytes); cookies/offsets can be exfiltrated through bpf_uprobe_multi_link_fill_link_info, giving arbitrary kernel memory read.\nI:H - Leaked kernel pointers and attacker-influenced offset/ref_ctr values feed uprobe_register() breakpoint installation, and the read primitive is standardly chained into arbitrary kernel write and privilege escalation.\nA:H - __get_user on non-userspace addresses can fault under SMAP/PAN and oops the kernel; even failed exploitation attempts can crash the host, and guidance treats serious uaccess bugs as high availability impact."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/bpf_trace.c"],"versions":[{"version":"89ae89f53d201143560f1e9ed4bfa62eee34f88e","lessThan":"c6d51ad36490013ee9df94a372d3bf794bd304d1","status":"affected","versionType":"git"},{"version":"89ae89f53d201143560f1e9ed4bfa62eee34f88e","lessThan":"4d87a251d45b4a95eb4c0abcfab809c9f231258a","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/bpf_trace.c"],"versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/c6d51ad36490013ee9df94a372d3bf794bd304d1"},{"url":"https://git.kernel.org/stable/c/4d87a251d45b4a95eb4c0abcfab809c9f231258a"}],"title":"bpf: Guard __get_user acesss with access_ok for uprobe_multi data","x_generator":{"engine":"bippy-1.2.0"}}}}