Linux Kernel CVE-2026-74364

Exploitation requires: (1) local access to a Linux system with BPF program loading capability - specifically CAP_BPF or effective root, as unprivileged BPF is typically restricted by default; (2) the target environment must use exclusive maps (excl_prog_sha binding) as a security mechanism, which is a feature of the signed BPF loader and not enabled in typical BPF deployments; and (3) the attacker must be able to load BPF programs and interact with map-in-map structures on the same host. The bypass is limited to the integrity guarantee of the exclusive map model - systems that do not use signed BPF loaders or exclusive maps gain no exploitable attack surface from this flaw. Remote exploitation is not possible per CVSS AV:L. The key limiting factor is the combination of local BPF privilege and the non-default signed-loader deployment pattern.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 7.1) accurately reflects a local, low-privilege attack with substantial confidentiality and integrity consequences and no availability impact. EPSS of 0.18% at the 7th percentile indicates the vulnerability has attracted virtually no attention from the exploit community, and there is no CISA KEV listing. Despite the 7.1 score, real-world risk is tightly constrained: exploitation requires local BPF-loading privilege (CAP_BPF), and the meaningful impact only materializes in environments using the signed BPF loader with exclusive maps as a trust boundary - a configuration that is not common in generic Linux deployments. The signal set here is consistent: high CVSS driven by the integrity bypass impact, but low community exploitation interest and no active exploitation evidence. Even a mid-sized municipal IT team in walbrzych running standard containerized workloads would only need to prioritize this if they have deployed signed BPF loader security models; generic production Linux hosts without exclusive BPF maps in their security architecture are functionally unaffected by this specific bypass. No conflicting signals detected; CVSS vector aligns with the described attack conditions.

A local attacker with CAP_BPF privilege creates a non-exclusive outer map and inserts an already-loaded exclusive map (belonging to a security-critical signed BPF program) as its inner map. The attacker then loads their own BPF program, performs a runtime lookup on the outer map to obtain a reference to the exclusive inner map, and overwrites its contents - including metadata that the signed loader has validated against a cryptographic hash. No public POC is known at time of analysis, but the technique follows directly from the described code path and requires no heap spraying or memory corruption.