CVE-2026-74363
bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning htab with internal structs") moved inode cleanup from ->free_inode() into ->destroy_inode() to avoid sleeping in RCU context when calling bpf_any_put(). However this removed the RCU delay on freeing the inode itself and the cached symlink body (i_link), both of which can be accessed by RCU pathwalk (pick_link, may_lookup etc.). This causes a use-after-free when a concurrent unlinkat() drops the last inode reference and destroy_inode() frees the inode immediately, while another task is still walking the path in RCU mode and reads inode->i_opflags (offset +2) inside current_time() -> is_mgtime(). KASAN reports: BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313 Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags) The rules (per Al Viro): ->destroy_inode() called immediately, can sleep, use for blocking cleanup e.g. bpf_any_put() ->free_inode() called after RCU grace period, use for freeing inode and anything RCU-accessible e.g. i_link Fix: split the two concerns properly: - keep bpf_any_put() in bpf_destroy_inode() since it is blocking and needs to run promptly - introduce bpf_free_inode() to handle kfree(i_link) and free_inode_nonrcu() with proper RCU delay, preventing the UAF
INFO
Published Date :
Aug. 15, 2026, 6:22 a.m.
Last Modified :
Aug. 15, 2026, 6:22 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-74363
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Ensure inode freeing respects RCU grace periods.
- Move RCU-accessible data freeing to free_inode().
- Call blocking cleanup in destroy_inode().
- Apply the provided patch to the Linux kernel.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-74363.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-74363 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-74363
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-74363 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-74363 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e28616ca3d67e745ecb2f10eba4a626e1fc9a203', 'lessThan': 'ea1c243c39e32b7fc1c2edfe32081ff7e30a877c', 'versionType': 'git'}, {'status': 'affected', 'version': '743a620c661994c7f0938e6dd32fb0883fb1e0ea', 'lessThan': '5fecb71c10c28aef276ba49c718dc961745fdcf0', 'versionType': 'git'}, {'status': 'affected', 'version': 'b6e9645be9eb93f7aff3ca887f8edb6f1d63358f', 'lessThan': 'c70d0f9114c3cc156f6029a400c4eb7e6f7c82b2', 'versionType': 'git'}, {'status': 'affected', 'version': 'ee04cff9ed4d6bb25802f5cecfcd0750500410f3', 'lessThan': '53649846e0437d1d9b7cb993cfe54c367addf7ae', 'versionType': 'git'}, {'status': 'affected', 'version': '4f375ade6aa9f37fd72d7a78682f639772089eed', 'lessThan': '61f19729728243c82476dee31315143ed3275e7f', 'versionType': 'git'}, {'status': 'affected', 'version': '4f375ade6aa9f37fd72d7a78682f639772089eed', 'lessThan': '0497ff765746d9b2d17445c8f7cc737b36c0152a', 'versionType': 'git'}, {'status': 'affected', 'version': '4f375ade6aa9f37fd72d7a78682f639772089eed', 'lessThan': 'b93c55b4932dd7e32dca8cf34a3443cc87a02906', 'versionType': 'git'}, {'status': 'affected', 'version': 'de2d2baecc84cc7fca52eec2b9b55d89c93e3565', 'versionType': 'git'}, {'status': 'affected', 'version': '5.15.195', 'lessThan': '5.15.212', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.157', 'lessThan': '6.1.178', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.6.113', 'lessThan': '6.6.145', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.12.54', 'lessThan': '6.12.97', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.17.4', 'lessThan': '6.18', 'versionType': 'semver'}], 'programFiles': ['kernel/bpf/inode.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.18'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.18', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['kernel/bpf/inode.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning htab with internal structs") moved inode cleanup from ->free_inode() into ->destroy_inode() to avoid sleeping in RCU context when calling bpf_any_put(). However this removed the RCU delay on freeing the inode itself and the cached symlink body (i_link), both of which can be accessed by RCU pathwalk (pick_link, may_lookup etc.). This causes a use-after-free when a concurrent unlinkat() drops the last inode reference and destroy_inode() frees the inode immediately, while another task is still walking the path in RCU mode and reads inode->i_opflags (offset +2) inside current_time() -> is_mgtime(). KASAN reports: BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313 Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags) The rules (per Al Viro): ->destroy_inode() called immediately, can sleep, use for blocking cleanup e.g. bpf_any_put() ->free_inode() called after RCU grace period, use for freeing inode and anything RCU-accessible e.g. i_link Fix: split the two concerns properly: - keep bpf_any_put() in bpf_destroy_inode() since it is blocking and needs to run promptly - introduce bpf_free_inode() to handle kfree(i_link) and free_inode_nonrcu() with proper RCU delay, preventing the UAF Added Reference https://git.kernel.org/stable/c/0497ff765746d9b2d17445c8f7cc737b36c0152a Added Reference https://git.kernel.org/stable/c/53649846e0437d1d9b7cb993cfe54c367addf7ae Added Reference https://git.kernel.org/stable/c/5fecb71c10c28aef276ba49c718dc961745fdcf0 Added Reference https://git.kernel.org/stable/c/61f19729728243c82476dee31315143ed3275e7f Added Reference https://git.kernel.org/stable/c/b93c55b4932dd7e32dca8cf34a3443cc87a02906 Added Reference https://git.kernel.org/stable/c/c70d0f9114c3cc156f6029a400c4eb7e6f7c82b2 Added Reference https://git.kernel.org/stable/c/ea1c243c39e32b7fc1c2edfe32081ff7e30a877c