bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74363
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-15 06:22:37 UTC
Updated2026-08-15 06:22:37 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning htab with internal structs") moved inode cleanup from ->free_inode() into ->destroy_inode() to avoid sleeping in RCU context when calling bpf_any_put(). However this removed the RCU delay on freeing the inode itself and the cached symlink body (i_link), both of which can be accessed by RCU pathwalk (pick_link, may_lookup etc.). This causes a use-after-free when a concurrent unlinkat() drops the last inode reference and destroy_inode() frees the inode immediately, while another task is still walking the path in RCU mode and reads inode->i_opflags (offset +2) inside current_time() -> is_mgtime(). KASAN reports: BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313 Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags) The rules (per Al Viro): ->destroy_inode() called immediately, can sleep, use for blocking cleanup e.g. bpf_any_put() ->free_inode() called after RCU grace period, use for freeing inode and anything RCU-accessible e.g. i_link Fix: split the two concerns properly: - keep bpf_any_put() in bpf_destroy_inode() since it is blocking and needs to run promptly - introduce bpf_free_inode() to handle kfree(i_link) and free_inode_nonrcu() with proper RCU delay, preventing the UAF

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected e28616ca3d67e745ecb2f10eba4a626e1fc9a203 ea1c243c39e32b7fc1c2edfe32081ff7e30a877c git Not specified
CNA Linux Linux affected 743a620c661994c7f0938e6dd32fb0883fb1e0ea 5fecb71c10c28aef276ba49c718dc961745fdcf0 git Not specified
CNA Linux Linux affected b6e9645be9eb93f7aff3ca887f8edb6f1d63358f c70d0f9114c3cc156f6029a400c4eb7e6f7c82b2 git Not specified
CNA Linux Linux affected ee04cff9ed4d6bb25802f5cecfcd0750500410f3 53649846e0437d1d9b7cb993cfe54c367addf7ae git Not specified
CNA Linux Linux affected 4f375ade6aa9f37fd72d7a78682f639772089eed 61f19729728243c82476dee31315143ed3275e7f git Not specified
CNA Linux Linux affected 4f375ade6aa9f37fd72d7a78682f639772089eed 0497ff765746d9b2d17445c8f7cc737b36c0152a git Not specified
CNA Linux Linux affected 4f375ade6aa9f37fd72d7a78682f639772089eed b93c55b4932dd7e32dca8cf34a3443cc87a02906 git Not specified
CNA Linux Linux affected de2d2baecc84cc7fca52eec2b9b55d89c93e3565 git Not specified
CNA Linux Linux affected 5.15.195 5.15.212 semver Not specified
CNA Linux Linux affected 6.1.157 6.1.178 semver Not specified
CNA Linux Linux affected 6.6.113 6.6.145 semver Not specified
CNA Linux Linux affected 6.12.54 6.12.97 semver Not specified
CNA Linux Linux affected 6.17.4 6.18 semver Not specified
CNA Linux Linux affected 6.18 Not specified
CNA Linux Linux unaffected 6.18 semver Not specified
CNA Linux Linux unaffected 5.15.212 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.178 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.145 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.97 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.40 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.5 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/53649846e0437d1d9b7cb993cfe54c367addf7ae 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b93c55b4932dd7e32dca8cf34a3443cc87a02906 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/61f19729728243c82476dee31315143ed3275e7f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ea1c243c39e32b7fc1c2edfe32081ff7e30a877c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c70d0f9114c3cc156f6029a400c4eb7e6f7c82b2 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5fecb71c10c28aef276ba49c718dc961745fdcf0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/0497ff765746d9b2d17445c8f7cc737b36c0152a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report