Vulnerability-Lookup

GHSA-84MH-PVR2-7X86

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

bpf: Cancel special fields on map value recycle

Map update and delete paths currently call bpf_obj_free_fields() when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete operation. For tracing programs this can include NMI context, where referenced kptr destructors, uptr unpinning, and graph root destruction are not generally safe.

Introduce bpf_obj_cancel_fields() for the reusable-value path. It only performs NMI-safe cleanup for timer, workqueue, and task_work fields. Fields that need full destruction are left attached to the recycled value and are destroyed by the final cleanup path instead.

Switch array and hashtab update/delete/recycle paths to this cancel helper. Keep bpf_obj_free_fields() for final map destruction and for bpf_mem_alloc destructors. Preallocated hashtabs do not have allocator destructors, so teardown continues to walk the normal and extra elements and fully destroy their fields.

This deliberately relaxes the eager-free semantics of map update/delete for special fields. Programs that relied on a recycled map slot becoming empty immediately after update/delete were relying on behavior that cannot be implemented safely from every BPF execution context without offloading arbitrary destructors.

There is a chance this change breaks programs making assumptions regarding the eager freeing of fields. If so, we can relax semantics to cancellation only when irqs_disabled() is true in the future. However, theoretically, map values that get reused eagerly already have weaker guarantees as parallel users can recreate freed fields before the new element becomes visible again.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74314"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:22:31Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Cancel special fields on map value recycle\n\nMap update and delete paths currently call bpf_obj_free_fields() when a\nvalue is being replaced or recycled. That makes field destruction depend\non the context of the update/delete operation. For tracing programs this\ncan include NMI context, where referenced kptr destructors, uptr\nunpinning, and graph root destruction are not generally safe.\n\nIntroduce bpf_obj_cancel_fields() for the reusable-value path. It only\nperforms NMI-safe cleanup for timer, workqueue, and task_work fields.\nFields that need full destruction are left attached to the recycled value\nand are destroyed by the final cleanup path instead.\n\nSwitch array and hashtab update/delete/recycle paths to this cancel\nhelper. Keep bpf_obj_free_fields() for final map destruction and for\nbpf_mem_alloc destructors. Preallocated hashtabs do not have allocator\ndestructors, so teardown continues to walk the normal and extra elements\nand fully destroy their fields.\n\nThis deliberately relaxes the eager-free semantics of map update/delete\nfor special fields. Programs that relied on a recycled map slot becoming\nempty immediately after update/delete were relying on behavior that\ncannot be implemented safely from every BPF execution context without\noffloading arbitrary destructors.\n\nThere is a chance this change breaks programs making assumptions\nregarding the eager freeing of fields. If so, we can relax semantics to\ncancellation only when irqs_disabled() is true in the future. However,\ntheoretically, map values that get reused eagerly already have weaker\nguarantees as parallel users can recreate freed fields before the new\nelement becomes visible again.",
  "id": "GHSA-84mh-pvr2-7x86",
  "modified": "2026-08-17T06:33:37Z",
  "published": "2026-08-15T06:32:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74314"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9ea734e2cc0143d7429ab7dc0b20c85e5836183c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a3a81d247651218e47153f2d2afd7aee236726fd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-74314 (GCVE-0-2026-74314)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:45

Title

bpf: Cancel special fields on map value recycle

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpf_obj_free_fields() when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete operation. For tracing programs this can include NMI context, where referenced kptr destructors, uptr unpinning, and graph root destruction are not generally safe. Introduce bpf_obj_cancel_fields() for the reusable-value path. It only performs NMI-safe cleanup for timer, workqueue, and task_work fields. Fields that need full destruction are left attached to the recycled value and are destroyed by the final cleanup path instead. Switch array and hashtab update/delete/recycle paths to this cancel helper. Keep bpf_obj_free_fields() for final map destruction and for bpf_mem_alloc destructors. Preallocated hashtabs do not have allocator destructors, so teardown continues to walk the normal and extra elements and fully destroy their fields. This deliberately relaxes the eager-free semantics of map update/delete for special fields. Programs that relied on a recycled map slot becoming empty immediately after update/delete were relying on behavior that cannot be implemented safely from every BPF execution context without offloading arbitrary destructors. There is a chance this change breaks programs making assumptions regarding the eager freeing of fields. If so, we can relax semantics to cancellation only when irqs_disabled() is true in the future. However, theoretically, map values that get reused eagerly already have weaker guarantees as parallel users can recreate freed fields before the new element becomes visible again.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/9ea734e2cc0143d74…
https://git.kernel.org/stable/c/a3a81d247651218e4…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 14a324f6a67ef6a53e04362a70160a47eb8afffa , < 9ea734e2cc0143d7429ab7dc0b20c85e5836183c (git) Affected: 14a324f6a67ef6a53e04362a70160a47eb8afffa , < a3a81d247651218e47153f2d2afd7aee236726fd (git) Affected: f0462d38589422bc9e27fd3c6343dfeb6b3db2f9 (git) Affected: 5.18.18 , < 5.19 (semver)
Linux	Linux	Affected: 5.19 Unaffected: 0 , < 5.19 (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/arraymap.c",
            "kernel/bpf/hashtab.c",
            "kernel/bpf/syscall.c",
            "tools/testing/selftests/bpf/prog_tests/htab_update.c",
            "tools/testing/selftests/bpf/prog_tests/linked_list.c",
            "tools/testing/selftests/bpf/prog_tests/map_kptr.c",
            "tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c",
            "tools/testing/selftests/bpf/progs/htab_update.c",
            "tools/testing/selftests/bpf/progs/linked_list.c",
            "tools/testing/selftests/bpf/progs/refcounted_kptr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9ea734e2cc0143d7429ab7dc0b20c85e5836183c",
              "status": "affected",
              "version": "14a324f6a67ef6a53e04362a70160a47eb8afffa",
              "versionType": "git"
            },
            {
              "lessThan": "a3a81d247651218e47153f2d2afd7aee236726fd",
              "status": "affected",
              "version": "14a324f6a67ef6a53e04362a70160a47eb8afffa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f0462d38589422bc9e27fd3c6343dfeb6b3db2f9",
              "versionType": "git"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.18",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/arraymap.c",
            "kernel/bpf/hashtab.c",
            "kernel/bpf/syscall.c",
            "tools/testing/selftests/bpf/prog_tests/htab_update.c",
            "tools/testing/selftests/bpf/prog_tests/linked_list.c",
            "tools/testing/selftests/bpf/prog_tests/map_kptr.c",
            "tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c",
            "tools/testing/selftests/bpf/progs/htab_update.c",
            "tools/testing/selftests/bpf/progs/linked_list.c",
            "tools/testing/selftests/bpf/progs/refcounted_kptr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Cancel special fields on map value recycle\n\nMap update and delete paths currently call bpf_obj_free_fields() when a\nvalue is being replaced or recycled. That makes field destruction depend\non the context of the update/delete operation. For tracing programs this\ncan include NMI context, where referenced kptr destructors, uptr\nunpinning, and graph root destruction are not generally safe.\n\nIntroduce bpf_obj_cancel_fields() for the reusable-value path. It only\nperforms NMI-safe cleanup for timer, workqueue, and task_work fields.\nFields that need full destruction are left attached to the recycled value\nand are destroyed by the final cleanup path instead.\n\nSwitch array and hashtab update/delete/recycle paths to this cancel\nhelper. Keep bpf_obj_free_fields() for final map destruction and for\nbpf_mem_alloc destructors. Preallocated hashtabs do not have allocator\ndestructors, so teardown continues to walk the normal and extra elements\nand fully destroy their fields.\n\nThis deliberately relaxes the eager-free semantics of map update/delete\nfor special fields. Programs that relied on a recycled map slot becoming\nempty immediately after update/delete were relying on behavior that\ncannot be implemented safely from every BPF execution context without\noffloading arbitrary destructors.\n\nThere is a chance this change breaks programs making assumptions\nregarding the eager freeing of fields. If so, we can relax semantics to\ncancellation only when irqs_disabled() is true in the future. However,\ntheoretically, map values that get reused eagerly already have weaker\nguarantees as parallel users can recreate freed fields before the new\nelement becomes visible again."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via bpf_map_update_elem/delete_elem on BPF array/hash maps, callable from the bpf() syscall and from in-kernel BPF helpers when tracing or perf BPF programs run; per kernel guidance BPF is a Local attack vector, not network-reachable.\nAC:L - An attacker who can load and attach BPF programs controls the map contents, update/delete timing, and trace/perf attach points (including NMI-capable hooks), so the unsafe bpf_obj_free_fields() recycle path is triggerable without luck or victim-specific state.\nPR:L - Exploitation requires loading tracing/perf BPF programs with BTF maps holding kptr/list/uptr fields (CAP_BPF plus CAP_PERFMON), which bpf_token_capable() grants to user-namespace CAP_SYS_ADMIN holders (e.g. unshare -Urn) and delegated BPF token users, not only init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers map recycle from their own loaded BPF program or concurrent bpf() map operations during tracing/perf events they control.\nS:U - Impact stays within kernel memory and privilege boundaries (deadlock, oops, memory corruption, potential local privilege escalation) and does not cross VM, container, or IOMMU security scopes on its own.\nC:H - Recycling map values from NMI/atomic tracing context runs bpf_obj_free_fields() kptr destructors, uptr unpinning, and graph teardown unsafely, enabling use-after-free and inconsistent object lifetimes that can be turned into arbitrary kernel memory disclosure.\nI:H - The same unsafe recycle path performs non-NMI-safe kptr destructor calls, recursive __bpf_obj_drop_impl() graph freeing, and uptr unpinning from wrong context, giving plausible heap corruption and control-flow hijack primitives beyond a simple crash.\nA:H - Calling bpf_obj_free_fields() from NMI/tracing contexts can deadlock on BPF/hash locks (documented IN-NMI lockdep failures in related BPF LRU fixes) or panic/oops via illegal page unpinning and destructor execution, fully denying kernel availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:47.130Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9ea734e2cc0143d7429ab7dc0b20c85e5836183c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3a81d247651218e47153f2d2afd7aee236726fd"
        }
      ],
      "title": "bpf: Cancel special fields on map value recycle",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74314",
    "datePublished": "2026-08-15T05:58:12.766Z",
    "dateReserved": "2026-08-15T05:44:03.883Z",
    "dateUpdated": "2026-08-17T05:45:47.130Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-84MH-PVR2-7X86

CVE-2026-74314 (GCVE-0-2026-74314)

Tags

Sightings

Nomenclature