Linux Kernel CVE-2026-74371

Exploitation requires local OS access with at least low-level privileges (CVSS PR:L) - specifically, the ability to invoke the bpf() syscall, which on most distributions requires either CAP_BPF, CAP_SYS_ADMIN, or kernel.unprivileged_bpf_disabled=0. The precise trigger is issuing BPF_PROG_QUERY with a cgroup-family attach type (e.g., BPF_CGROUP_INET_INGRESS or BPF_CGROUP_SOCK) while passing a bpf_attr buffer that does not extend to cover the query.revision field - specifically a buffer smaller than the offset of that field in the current kernel's struct layout. The tcx and netkit attach types (BPF_TCX_INGRESS, BPF_TCX_EGRESS, BPF_NETKIT_PRIMARY, BPF_NETKIT_PEER) are structurally similar but do not share the legacy hazard because revision shipped with those commands from the start. Exploitation is blocked by: kernel.unprivileged_bpf_disabled=1, AppArmor or SELinux BPF deny policies, seccomp filters rejecting bpf() syscall, or absence of CAP_BPF/CAP_SYS_ADMIN in the calling process. No user interaction or network access is required.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly reflects local, low-complexity exploitation requiring low OS-level privileges with potential for full system compromise. The EPSS score of 0.17% (6th percentile) is consistent with the local-only vector and the non-trivial gap between triggering the OOB write and achieving reliable privilege escalation - kernel memory corruption exploits demand significant craft. There is no CISA KEV listing and no confirmed public proof-of-concept, making this a patch-and-harden priority rather than an emergency incident-response trigger. Real-world risk is elevated for multi-tenant environments (shared hosting, container clusters, CI systems) where low-privileged local users have unrestricted access to the bpf() syscall. Systems with kernel.unprivileged_bpf_disabled=1, AppArmor BPF policies, or seccomp filters denying bpf() to untrusted users have substantially reduced exposure. The high C/I/A impact scores are not in conflict with the low EPSS - they reflect worst-case post-exploitation impact, not exploitation likelihood.

A local user on a shared Linux system - such as a CI runner participant, container tenant, or unprivileged service account - invokes the bpf() syscall with BPF_PROG_QUERY targeting a cgroup attach type, deliberately passing a bpf_attr buffer sized to the pre-v6.6 layout that omits the query.revision field. The kernel writes the revision value past the end of the caller's buffer, corrupting adjacent userspace memory in a layout the attacker can control to redirect execution or escalate privileges. No public proof-of-concept exists at time of analysis, and achieving reliable exploitation requires non-trivial heap shaping.