EUVD-2026-59461
GHSA-84mh-pvr2-7x86
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector with CAP_BPF required (AV:L, PR:L); NMI-unsafe destructor execution enables kernel memory corruption affecting confidentiality, integrity, and availability.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
bpf: Cancel special fields on map value recycle
Map update and delete paths currently call bpf_obj_free_fields() when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete operation. For tracing programs this can include NMI context, where referenced kptr destructors, uptr unpinning, and graph root destruction are not generally safe.
Introduce bpf_obj_cancel_fields() for the reusable-value path. It only performs NMI-safe cleanup for timer, workqueue, and task_work fields. Fields that need full destruction are left attached to the recycled value and are destroyed by the final cleanup path instead.
Switch array and hashtab update/delete/recycle paths to this cancel helper. Keep bpf_obj_free_fields() for final map destruction and for bpf_mem_alloc destructors. Preallocated hashtabs do not have allocator destructors, so teardown continues to walk the normal and extra elements and fully destroy their fields.
This deliberately relaxes the eager-free semantics of map update/delete for special fields. Programs that relied on a recycled map slot becoming empty immediately after update/delete were relying on behavior that cannot be implemented safely from every BPF execution context without offloading arbitrary destructors.
There is a chance this change breaks programs making assumptions regarding the eager freeing of fields. If so, we can relax semantics to cancellation only when irqs_disabled() is true in the future. However, theoretically, map values that get reused eagerly already have weaker guarantees as parallel users can recreate freed fields before the new element becomes visible again.
AnalysisAI
Unsafe destructor execution in the Linux kernel BPF subsystem allows a local attacker with BPF program loading privileges to trigger memory corruption by causing map value cleanup routines to run from NMI (Non-Maskable Interrupt) context. The flaw affects array and hashtab BPF maps containing special fields such as referenced kptrs, uptr, timer, workqueue, and graph roots - destructors for these types are not NMI-safe, yet tracing BPF programs can invoke map update or delete operations from that context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local system access and the CAP_BPF or CAP_SYS_ADMIN capability to load BPF programs - unprivileged users cannot exploit this. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.8 (High) with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a locally exploitable flaw with potentially full kernel compromise - but real-world risk is substantially modulated by the requirement to hold CAP_BPF or CAP_SYS_ADMIN and craft a tracing program that deliberately exercises NMI-context map operations. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with CAP_BPF privileges writes a BPF tracing program that populates a hashtab map with values containing referenced kptrs or graph roots, then attaches the program to a perf event or kprobe that fires in NMI context. When the program triggers a map update or delete from NMI, bpf_obj_free_fields() executes a kptr destructor or graph root teardown that is not NMI-safe, causing a kernel memory corruption condition that may be leveraged for privilege escalation. … |
| Remediation | Apply the upstream stable kernel patches committed at https://git.kernel.org/stable/c/9ea734e2cc0143d7429ab7dc0b20c85e5836183c and https://git.kernel.org/stable/c/a3a81d247651218e47153f2d2afd7aee236726fd, which introduce bpf_obj_cancel_fields() and switch array and hashtab map paths to NMI-safe cleanup. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify Linux systems with BPF program loading capabilities and determine which kernel versions at your organization are vulnerable per vendor security advisories for CVE-2026-74314; confirm patch availability through your Linux distribution vendor. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today