EUVD-2026-59452
GHSA-7p9j-gmgx-g4fv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only vector confirmed by description; CAP_BPF required sets PR:L; crafting the BPF chain is straightforward once privilege is held (AC:L); OOB kernel access yields full C/I/A impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
bpf: Tighten cgroup storage cookie checks for prog arrays
The fix in commit abad3d0bad72 ("bpf: Fix oob access in cgroup local storage") is still incomplete. The prog-array compatibility check treats a program with no cgroup storage as compatible with any stored storage cookie. This allows a storage-less program to bridge a tail call chain between an entry program and a storage-using callee even though cgroup local storage at runtime still follows the caller's context, that is, A -> B(no storage) -> C(storage) path.
Requiring exact cookie equality would break the legitimate case of a storage-less leaf program being tail called from a storage-using one. Instead, only accept a zero storage cookie if the program cannot perform tail calls itself. This keeps A -> B(no storage) working while rejecting the A -> B(no storage) -> C(storage) bridge.
AnalysisAI
Out-of-bounds memory access in the Linux kernel BPF cgroup storage subsystem exposes multiple stable kernel branches to local privilege escalation, stemming from an incomplete fix for predecessor commit abad3d0bad72. A local attacker with CAP_BPF privilege can construct a tail call chain using a storage-less intermediate BPF program as a bridge between two cgroup-storage-using programs (A→B(no storage)→C(storage)), bypassing cookie validation and causing runtime cgroup local storage in the callee to operate on the original caller's context, triggering an out-of-bounds kernel memory access with C:H/I:H/A:H impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local system access with CAP_BPF or CAP_SYS_ADMIN privilege - as confirmed by CVSS PR:L; (2) the ability to load and attach BPF programs to a cgroup using a prog-array, with at least one program in the chain having no cgroup storage attachment (zero cookie) positioned as an intermediate between two programs that do use cgroup local storage; (3) a system running cgroup v2 with BPF cgroup programs actively in use. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate-to-high for environments that grant unprivileged or container-scoped BPF loading. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user or container process holding CAP_BPF crafts a prog-array that positions a storage-less BPF program as an intermediate node between a cgroup-storage-using entry program and a cgroup-storage-using tail callee. When the kernel executes the tail call chain, the storage-less bridge passes the zero-cookie compatibility check, allowing the callee to access cgroup local storage indexed by the original entry program's cookie rather than its own, triggering an out-of-bounds kernel memory access that can be leveraged for local privilege escalation or sensitive kernel memory disclosure. … |
| Remediation | The primary fix is to upgrade to a patched stable kernel release matching your running branch: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, consult your Linux vendor's security advisory for CVE-2026-74305 to determine which kernel versions in your environment are affected (the vulnerability spans multiple stable branches). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today