Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-74338— bpf: Reject sleepable BPF_LSM_CGROUP programs at load time

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.0版本存在安全漏洞，该漏洞源于BPF验证器未在加载时拒绝可睡眠的BPF_LSM_CGROUP程序，可能导致内核错误。

CVSS 7.8 · High EPSS 0.13% · P3

Possible ATT&CK Techniques 1AI

T1055.001 · Dynamic-link Library Injection

Affected Version Matrix 6

VendorProductVersion RangeStatus
LinuxLinux69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e< be9eaf2bb5db4ad3de61ef739fd268fd7f135737affected
69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e< 5b038319be442c620f774e6fc9e9283deeca1c75affected
6.0affected
< 6.0unaffected
7.1.5≤ 7.1.*unaffected
7.2≤ *unaffected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-74338

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time The cgroup shim runs under rcu_read_lock_dont_migrate(), so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts to load sleepable BPF programs destined for LSM cgroup attachment. Without this, we get the following splat from a BPF_LSM_CGROUP program marked BPF_F_SLEEPABLE attached to file_open when it calls bpf_get_dentry_xattr(): BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1567 in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 34317, name: load preempt_count: 0, expected: 0 RCU nest depth: 2, expected: 0 Call Trace: down_read+0x76/0x480 ext4_xattr_get+0x11f/0x700 __vfs_getxattr+0xf0/0x150 bpf_get_dentry_xattr+0xbb/0xf0 bpf_prog_e76a298dac9218c6_test_open+0x6a/0x85 __cgroup_bpf_run_lsm_current+0x326/0x840 bpf_trampoline_6442534646+0x62/0x14d security_file_open+0x34/0x60 do_dentry_open+0x340/0x1260 vfs_open+0x7a/0x440 path_openat+0x1bac/0x30a0 libbpf provides a .s named section variant for every sleepable program type except lsm_cgroup, reflecting that per-cgroup LSM programs are intended to only run in a non-sleepable context. The above splat was obtained by bypassing libbpf by using bpf(2) directly.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.0版本存在安全漏洞，该漏洞源于BPF验证器未在加载时拒绝可睡眠的BPF_LSM_CGROUP程序，可能导致内核错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e ~ be9eaf2bb5db4ad3de61ef739fd268fd7f135737 -
LinuxLinux 6.0 -

II. Public POCs for CVE-2026-74338

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74338

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74338 (2)

Same Patch Batch · Linux · 2026-08-15 · 845 CVEs total

CVE-2026-7428010.0 CRITICALcrypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-7447510.0 CRITICALvxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-7240710.0 CRITICALgeneve: validate inner network offset in geneve_gro_complete()
CVE-2026-7430910.0 CRITICALvdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-7240810.0 CRITICALgeneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-7242110.0 CRITICALipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-7427910.0 CRITICALcrypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-724939.9 CRITICALnet: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-743509.8 CRITICALocfs2: validate fast symlink target during inode read
CVE-2026-722519.8 CRITICALnetfilter: nf_nat_sip: reload possible stale data pointer
CVE-2026-722499.8 CRITICALnetfilter: flowtable: use dst in this direction when pushing IPIP header
CVE-2026-722489.8 CRITICALnetfilter: flowtable: support IPIP tunnel with direct xmit
CVE-2026-724949.8 CRITICALRDMA/irdma: Replace waitqueue and flag with completion
CVE-2026-720839.8 CRITICALscsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
CVE-2026-720989.8 CRITICALdm-verity: fix buffer overflow in FEC calculation
CVE-2026-722269.8 CRITICALbatman-adv: tt: prevent TVLV OOB check overflow
CVE-2026-742559.8 CRITICALtipc: fix UAF in tipc_l2_send_msg()
CVE-2026-744289.8 CRITICALrxrpc: Fix double unlock in rxrpc_recvmsg()
CVE-2026-720849.8 CRITICALscsi: target: Bound PR-OUT TransportID parsing to the received buffer
CVE-2026-722349.8 CRITICALbatman-adv: access unicast_ttvn skb->data only after skb realloc

Showing top 20 of 845 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74338

No comments yet

Leave a comment