GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74364 (GCVE-0-2026-74364)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:46
VLAI
Title
bpf: Reject exclusive maps as inner maps in map-in-map
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map (created with excl_prog_hash) is bound to a single program by hash: check_map_prog_compatibility() refuses to load any program whose digest does not match map->excl_prog_sha. That check only runs for maps a program references directly, i.e. its used_maps. A map reached at runtime through a map-of-maps is never in used_maps, and bpf_map_meta_equal() does not consider excl_prog_sha, so an exclusive map can be inserted into a non-exclusive outer map and then looked up and mutated by an unrelated program, bypassing the exclusivity guarantee. For the signed loader this defeats the metadata map exclusivity check added in the signed loader: the cached map->sha[] is validated against the signed hash while another program on a hostile host rewrites the frozen map's contents through the outer map.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: baefdbdf6812e120c9fba9cfb101d3656f478026 , < 3a0f73d27a8d379a8852a378b3c3208143e3b3b2 (git)
Affected: baefdbdf6812e120c9fba9cfb101d3656f478026 , < 7c58ace08f180f8e249e714d1623388362f9d807 (git)
Affected: baefdbdf6812e120c9fba9cfb101d3656f478026 , < 9a3c3c49c333760c8944dadacbe114c1884546ef (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/map_in_map.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3a0f73d27a8d379a8852a378b3c3208143e3b3b2",
              "status": "affected",
              "version": "baefdbdf6812e120c9fba9cfb101d3656f478026",
              "versionType": "git"
            },
            {
              "lessThan": "7c58ace08f180f8e249e714d1623388362f9d807",
              "status": "affected",
              "version": "baefdbdf6812e120c9fba9cfb101d3656f478026",
              "versionType": "git"
            },
            {
              "lessThan": "9a3c3c49c333760c8944dadacbe114c1884546ef",
              "status": "affected",
              "version": "baefdbdf6812e120c9fba9cfb101d3656f478026",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/map_in_map.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject exclusive maps as inner maps in map-in-map\n\nAn exclusive map (created with excl_prog_hash) is bound to a single\nprogram by hash: check_map_prog_compatibility() refuses to load any\nprogram whose digest does not match map-\u003eexcl_prog_sha. That check\nonly runs for maps a program references directly, i.e. its used_maps.\nA map reached at runtime through a map-of-maps is never in used_maps,\nand bpf_map_meta_equal() does not consider excl_prog_sha, so an\nexclusive map can be inserted into a non-exclusive outer map and\nthen looked up and mutated by an unrelated program, bypassing the\nexclusivity guarantee.\n\nFor the signed loader this defeats the metadata map exclusivity check\nadded in the signed loader: the cached map-\u003esha[] is validated against\nthe signed hash while another program on a hostile host rewrites the\nfrozen map\u0027s contents through the outer map."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only through bpf(2) syscalls (BPF_MAP_CREATE, BPF_MAP_UPDATE_ELEM, BPF_PROG_LOAD) and runtime BPF helpers on map-in-map structures, which per kernel guidance is a local attack vector.\nAC:L - Exploitation is a reliable, attacker-controlled sequence (create outer map-of-maps, insert exclusive inner map FD, load program referencing only outer map, lookup/mutate inner map) with no races or layout dependencies.\nPR:L - Triggering the vulnerable map-in-map paths requires local BPF privileges (typically CAP_BPF); per kernel guidance this is Low because CAP_BPF can be obtained by unprivileged users via user namespaces, not only init-namespace root.\nUI:N - No victim interaction is required; a local attacker with BPF access can create the outer map, insert the exclusive inner map, and mutate it through an unrelated loaded program without actions by other users.\nS:U - The impact is bypass of BPF exclusive-map and signed-loader integrity controls within the kernel BPF subsystem, not crossing a VM, container-to-host, or IOMMU security boundary.\nC:H - An unrelated BPF program can bpf_map_lookup_elem() an exclusive inner map via map-in-map indirection and read its full contents, including signed metadata and hashes that must remain confidential to unauthorized programs.\nI:H - The same indirection allows bpf_map_update_elem() on an exclusive map bound to a different program digest, defeating exclusivity and enabling rewrite of signed-loader metadata (map-\u003esha[]) and other protected map state.\nA:N - This is an access-control bypass without memory corruption, use-after-free, or kernel panic; exploitation does not inherently cause crashes, hangs, or denial of kernel availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:23.107Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3a0f73d27a8d379a8852a378b3c3208143e3b3b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c58ace08f180f8e249e714d1623388362f9d807"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a3c3c49c333760c8944dadacbe114c1884546ef"
        }
      ],
      "title": "bpf: Reject exclusive maps as inner maps in map-in-map",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74364",
    "datePublished": "2026-08-15T05:58:46.926Z",
    "dateReserved": "2026-08-15T05:44:03.887Z",
    "dateUpdated": "2026-08-17T05:46:23.107Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74364",
      "date": "2026-09-04",
      "epss": "0.00132",
      "percentile": "0.03099"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74364\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:38.037\",\"lastModified\":\"2026-08-17T06:19:31.187\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Reject exclusive maps as inner maps in map-in-map\\n\\nAn exclusive map (created with excl_prog_hash) is bound to a single\\nprogram by hash: check_map_prog_compatibility() refuses to load any\\nprogram whose digest does not match map-\u003eexcl_prog_sha. That check\\nonly runs for maps a program references directly, i.e. its used_maps.\\nA map reached at runtime through a map-of-maps is never in used_maps,\\nand bpf_map_meta_equal() does not consider excl_prog_sha, so an\\nexclusive map can be inserted into a non-exclusive outer map and\\nthen looked up and mutated by an unrelated program, bypassing the\\nexclusivity guarantee.\\n\\nFor the signed loader this defeats the metadata map exclusivity check\\nadded in the signed loader: the cached map-\u003esha[] is validated against\\nthe signed hash while another program on a hostile host rewrites the\\nfrozen map\u0027s contents through the outer map.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/bpf/map_in_map.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"baefdbdf6812e120c9fba9cfb101d3656f478026\",\"lessThan\":\"3a0f73d27a8d379a8852a378b3c3208143e3b3b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"baefdbdf6812e120c9fba9cfb101d3656f478026\",\"lessThan\":\"7c58ace08f180f8e249e714d1623388362f9d807\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"baefdbdf6812e120c9fba9cfb101d3656f478026\",\"lessThan\":\"9a3c3c49c333760c8944dadacbe114c1884546ef\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/bpf/map_in_map.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3a0f73d27a8d379a8852a378b3c3208143e3b3b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7c58ace08f180f8e249e714d1623388362f9d807\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9a3c3c49c333760c8944dadacbe114c1884546ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T08:03:17+00:00",
      "cve": "CVE-2026-74364",
      "id": "CVE-2026-74364",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Reject exclusive maps as inner maps in map-in-map",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74364.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.