Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-74363— bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.18版本存在安全漏洞，该漏洞源于bpffs中inode释放未经过RCU延迟，导致释放后重用，可能允许攻击者利用并发unlinkat触发释放后重用，导致信息泄露或系统崩溃。

CVSS 7.8 · High EPSS 0.12% · P2

Possible ATT&CK Techniques 1 AI

T1206

Affected Version Matrix 22

VendorProduct Version RangeStatus
Linux Linux e28616ca3d67e745ecb2f10eba4a626e1fc9a203< ea1c243c39e32b7fc1c2edfe32081ff7e30a877c affected
743a620c661994c7f0938e6dd32fb0883fb1e0ea< 5fecb71c10c28aef276ba49c718dc961745fdcf0 affected
b6e9645be9eb93f7aff3ca887f8edb6f1d63358f< c70d0f9114c3cc156f6029a400c4eb7e6f7c82b2 affected
ee04cff9ed4d6bb25802f5cecfcd0750500410f3< 53649846e0437d1d9b7cb993cfe54c367addf7ae affected
4f375ade6aa9f37fd72d7a78682f639772089eed< 61f19729728243c82476dee31315143ed3275e7f affected
4f375ade6aa9f37fd72d7a78682f639772089eed< 0497ff765746d9b2d17445c8f7cc737b36c0152a affected
4f375ade6aa9f37fd72d7a78682f639772089eed< b93c55b4932dd7e32dca8cf34a3443cc87a02906 affected
de2d2baecc84cc7fca52eec2b9b55d89c93e3565 affected
… +14 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74363

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning htab with internal structs") moved inode cleanup from ->free_inode() into ->destroy_inode() to avoid sleeping in RCU context when calling bpf_any_put(). However this removed the RCU delay on freeing the inode itself and the cached symlink body (i_link), both of which can be accessed by RCU pathwalk (pick_link, may_lookup etc.). This causes a use-after-free when a concurrent unlinkat() drops the last inode reference and destroy_inode() frees the inode immediately, while another task is still walking the path in RCU mode and reads inode->i_opflags (offset +2) inside current_time() -> is_mgtime(). KASAN reports: BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313 Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags) The rules (per Al Viro): ->destroy_inode() called immediately, can sleep, use for blocking cleanup e.g. bpf_any_put() ->free_inode() called after RCU grace period, use for freeing inode and anything RCU-accessible e.g. i_link Fix: split the two concerns properly: - keep bpf_any_put() in bpf_destroy_inode() since it is blocking and needs to run promptly - introduce bpf_free_inode() to handle kfree(i_link) and free_inode_nonrcu() with proper RCU delay, preventing the UAF
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.18版本存在安全漏洞，该漏洞源于bpffs中inode释放未经过RCU延迟，导致释放后重用，可能允许攻击者利用并发unlinkat触发释放后重用，导致信息泄露或系统崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux e28616ca3d67e745ecb2f10eba4a626e1fc9a203 ~ ea1c243c39e32b7fc1c2edfe32081ff7e30a877c -
Linux Linux 6.18 -

II. Public POCs for CVE-2026-74363

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74363

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74363 (6)

Same Patch Batch · Linux · 2026-08-15 · 845 CVEs total

CVE-2026-74280 10.0 CRITICAL crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-74279 10.0 CRITICAL crypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-72421 10.0 CRITICAL ipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-74475 10.0 CRITICAL vxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-72408 10.0 CRITICAL geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-72407 10.0 CRITICAL geneve: validate inner network offset in geneve_gro_complete()
CVE-2026-74309 10.0 CRITICAL vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-72493 9.9 CRITICAL net: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-72041 9.8 CRITICAL espintcp: use sk_msg_free_partial to fix partial send
CVE-2026-74436 9.8 CRITICAL rxrpc: serialize kernel accept preallocation with socket teardown
CVE-2026-72211 9.8 CRITICAL ntfs: grow index root value before reparent header update
CVE-2026-72209 9.8 CRITICAL ntfs: validate attribute values on lookup
CVE-2026-72208 9.8 CRITICAL ntfs: add bounds check before accessing EA entries
CVE-2026-72299 9.8 CRITICAL tipc: restrict socket queue dumps in enqueue tracepoints
CVE-2026-74434 9.8 CRITICAL rxrpc: Don't move a peeked OOB message onto the pending queue
CVE-2026-74433 9.8 CRITICAL rxrpc: Fix UAF in rxgk_issue_challenge()
CVE-2026-72473 9.8 CRITICAL xprtrdma: Decouple req recycling from RPC completion
CVE-2026-72472 9.8 CRITICAL nfs: use nfsi->rwsem to protect traversal of the file lock list
CVE-2026-74545 9.8 CRITICAL rtase: fix double free of multi-frag skb on DMA map failure
CVE-2026-72322 9.8 CRITICAL ipv6: mcast: Fix potential UAF in MLD delayed work

Showing top 20 of 845 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74363

No comments yet

Leave a comment