{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74363","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.887Z","datePublished":"2026-08-15T05:58:46.220Z","dateUpdated":"2026-08-17T05:46:21.981Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:46:21.981Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix UAF by restoring RCU-delayed inode freeing in bpffs\n\ncommit 4f375ade6aa9 (\"bpf: Avoid RCU context warning when unpinning\nhtab with internal structs\") moved inode cleanup from ->free_inode()\ninto ->destroy_inode() to avoid sleeping in RCU context when calling\nbpf_any_put(). However this removed the RCU delay on freeing the\ninode itself and the cached symlink body (i_link), both of which\ncan be accessed by RCU pathwalk (pick_link, may_lookup etc.).\n\nThis causes a use-after-free when a concurrent unlinkat() drops the\nlast inode reference and destroy_inode() frees the inode immediately,\nwhile another task is still walking the path in RCU mode and reads\ninode->i_opflags (offset +2) inside current_time() -> is_mgtime().\n\nKASAN reports:\n  BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313\n  Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags)\n\nThe rules (per Al Viro):\n  ->destroy_inode()  called immediately, can sleep, use for blocking\n                     cleanup e.g. bpf_any_put()\n  ->free_inode()     called after RCU grace period, use for freeing\n                     inode and anything RCU-accessible e.g. i_link\n\nFix: split the two concerns properly:\n  - keep bpf_any_put() in bpf_destroy_inode() since it is blocking\n    and needs to run promptly\n  - introduce bpf_free_inode() to handle kfree(i_link) and\n    free_inode_nonrcu() with proper RCU delay, preventing the UAF"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is triggered through local VFS and bpf(2) syscalls on bpffs (unlinkat/symlinkat/openat/stat and BPF_OBJ_GET/BPF_OBJ_PIN) racing RCU pathwalk; BPF/bpffs is not reachable from remote network services.\nAC:L - Exploitation requires a race between unlinkat dropping the last bpffs inode reference and concurrent RCU pathwalk, but the attacker controls both sides with parallel threads/syscalls and syzbot reliably reproduces the UAF without external timing.\nPR:L - Any local user with write access to a bpffs mount (default sticky world-writable /sys/fs/bpf) can create symlinks or pin/unpin BPF objects without init-namespace root, including via unprivileged BPF or delegated bpffs mounts in user namespaces.\nUI:N - No victim action is required; the attacker programmatically races their own unlink/pathwalk operations on bpffs objects they can create and remove.\nS:U - This is a kernel heap use-after-free in bpffs inode lifetime management, enabling local privilege escalation within the same security domain rather than crossing VM, IOMMU, or sandbox boundaries.\nC:H - KASAN confirmed slab use-after-free reading freed inode->i_opflags during RCU pathwalk; UAF of struct inode enables subsequent arbitrary kernel memory disclosure via heap reuse.\nI:H - Premature inode freeing permits attacker-controlled heap reuse and spraying, providing a standard kernel UAF path to arbitrary write and potential code execution beyond the initial 2-byte read.\nA:H - Concurrent RCU pathwalk of a prematurely freed bpffs inode triggers KASAN slab-UAF and kernel oops; repeated triggering can panic the system or cause denial of service."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/bpf/inode.c"],"versions":[{"version":"e28616ca3d67e745ecb2f10eba4a626e1fc9a203","lessThan":"ea1c243c39e32b7fc1c2edfe32081ff7e30a877c","status":"affected","versionType":"git"},{"version":"743a620c661994c7f0938e6dd32fb0883fb1e0ea","lessThan":"5fecb71c10c28aef276ba49c718dc961745fdcf0","status":"affected","versionType":"git"},{"version":"b6e9645be9eb93f7aff3ca887f8edb6f1d63358f","lessThan":"c70d0f9114c3cc156f6029a400c4eb7e6f7c82b2","status":"affected","versionType":"git"},{"version":"ee04cff9ed4d6bb25802f5cecfcd0750500410f3","lessThan":"53649846e0437d1d9b7cb993cfe54c367addf7ae","status":"affected","versionType":"git"},{"version":"4f375ade6aa9f37fd72d7a78682f639772089eed","lessThan":"61f19729728243c82476dee31315143ed3275e7f","status":"affected","versionType":"git"},{"version":"4f375ade6aa9f37fd72d7a78682f639772089eed","lessThan":"0497ff765746d9b2d17445c8f7cc737b36c0152a","status":"affected","versionType":"git"},{"version":"4f375ade6aa9f37fd72d7a78682f639772089eed","lessThan":"b93c55b4932dd7e32dca8cf34a3443cc87a02906","status":"affected","versionType":"git"},{"version":"de2d2baecc84cc7fca52eec2b9b55d89c93e3565","status":"affected","versionType":"git"},{"version":"5.15.195","lessThan":"5.15.212","status":"affected","versionType":"semver"},{"version":"6.1.157","lessThan":"6.1.178","status":"affected","versionType":"semver"},{"version":"6.6.113","lessThan":"6.6.145","status":"affected","versionType":"semver"},{"version":"6.12.54","lessThan":"6.12.97","status":"affected","versionType":"semver"},{"version":"6.17.4","lessThan":"6.18","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/bpf/inode.c"],"versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","status":"unaffected","versionType":"semver"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.195","versionEndExcluding":"5.15.212"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.157","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.113","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.54","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17.4"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/ea1c243c39e32b7fc1c2edfe32081ff7e30a877c"},{"url":"https://git.kernel.org/stable/c/5fecb71c10c28aef276ba49c718dc961745fdcf0"},{"url":"https://git.kernel.org/stable/c/c70d0f9114c3cc156f6029a400c4eb7e6f7c82b2"},{"url":"https://git.kernel.org/stable/c/53649846e0437d1d9b7cb993cfe54c367addf7ae"},{"url":"https://git.kernel.org/stable/c/61f19729728243c82476dee31315143ed3275e7f"},{"url":"https://git.kernel.org/stable/c/0497ff765746d9b2d17445c8f7cc737b36c0152a"},{"url":"https://git.kernel.org/stable/c/b93c55b4932dd7e32dca8cf34a3443cc87a02906"}],"title":"bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs","x_generator":{"engine":"bippy-1.2.0"}}}}