CVE-2026-74354

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74354", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.887Z", "datePublished": "2026-08-15T05:58:40.067Z", "dateUpdated": "2026-10-16T18:55:34.866Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:46:14.991Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Take mmap_lock in zap_pages()\n\nzap_vma_range() requires the owning mm's mmap_lock to be held.\n\nTaking mmap_read_lock under arena->lock would AB-BA against\narena_vm_close() and arena_map_mmap(), both of which run with\nmmap_write_lock held and then acquire arena->lock. Instead drop\narena->lock, mmget_not_zero() the vma's mm, take mmap_read_lock, and\nre-resolve the vma via find_vma() since it may have been unmapped or\nreplaced while waiting.\n\nTrack processed vmls with a per-call generation in vml->zap_gen and\nserialize zap_pages() callers with a new arena->zap_mutex so\nconcurrent callers on different uaddr ranges do not mark each other's\nvmls processed before the zap is done."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is reached only via local bpf(2) syscalls: creating a BPF_MAP_TYPE_ARENA, loading a JIT BPF program using bpf_arena_free_pages(), mmap()ing the arena, and executing that program, which calls zap_pages() and zap_vma_range() without mmap_lock.\nAC:L - Exploitation requires racing page unmap with concurrent VMA teardown; the attacker controls both sides by running bpf_arena_free_pages() from BPF while another thread or process concurrently munmap()s or remaps the same arena mapping.\nPR:L - Arena map creation requires CAP_BPF and verifier-enforced CAP_BPF plus CAP_PERFMON (bpf_allow_ptr_leaks), not init-namespace root; these capabilities are obtainable by an unprivileged user via user namespaces or perf-group membership on typical systems.\nUI:N - No victim interaction is required beyond the attacker loading their own BPF program and mmaping their own arena; triggering the race is fully automated once those attacker-controlled setup steps are done.\nS:U - Impact is confined to kernel memory management and process address spaces on the host; it does not cross a VM, container, or IOMMU security boundary into a separate authority such as a hypervisor host escape.\nC:H - Calling zap_vma_range() without mmap_lock races with munmap and page faults, enabling stale VMA use, page-table corruption, and use-after-free conditions that can be leveraged for arbitrary kernel or cross-process memory disclosure.\nI:H - Unsynchronized PTE zapping and rmap updates can corrupt page tables and VMA metadata, providing memory corruption primitives that can be developed into arbitrary kernel writes and control-flow hijacking.\nA:H - The mmap_lock violation can cause kernel oopses, panics, or hung memory management from inconsistent page tables and invalid VMA access during concurrent unmap operations."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/arena.c"], "versions": [{"version": "317460317a02a1af512697e6e964298dedd8a163", "lessThan": "36b1d997866f6083d33934983aa2ce0a184ed642", "status": "affected", "versionType": "git"}, {"version": "317460317a02a1af512697e6e964298dedd8a163", "lessThan": "80b89d0226a05e8b67969de99c31b51fcd54f76a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/arena.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/36b1d997866f6083d33934983aa2ce0a184ed642"}, {"url": "https://git.kernel.org/stable/c/80b89d0226a05e8b67969de99c31b51fcd54f76a"}], "title": "bpf: Take mmap_lock in zap_pages()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74354", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:54:18.946852Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:34.866Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74354", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:54:18.946852Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:54:19.879Z"}}], "cna": {"title": "bpf: Take mmap_lock in zap_pages()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is reached only via local bpf(2) syscalls: creating a BPF_MAP_TYPE_ARENA, loading a JIT BPF program using bpf_arena_free_pages(), mmap()ing the arena, and executing that program, which calls zap_pages() and zap_vma_range() without mmap_lock.\nAC:L - Exploitation requires racing page unmap with concurrent VMA teardown; the attacker controls both sides by running bpf_arena_free_pages() from BPF while another thread or process concurrently munmap()s or remaps the same arena mapping.\nPR:L - Arena map creation requires CAP_BPF and verifier-enforced CAP_BPF plus CAP_PERFMON (bpf_allow_ptr_leaks), not init-namespace root; these capabilities are obtainable by an unprivileged user via user namespaces or perf-group membership on typical systems.\nUI:N - No victim interaction is required beyond the attacker loading their own BPF program and mmaping their own arena; triggering the race is fully automated once those attacker-controlled setup steps are done.\nS:U - Impact is confined to kernel memory management and process address spaces on the host; it does not cross a VM, container, or IOMMU security boundary into a separate authority such as a hypervisor host escape.\nC:H - Calling zap_vma_range() without mmap_lock races with munmap and page faults, enabling stale VMA use, page-table corruption, and use-after-free conditions that can be leveraged for arbitrary kernel or cross-process memory disclosure.\nI:H - Unsynchronized PTE zapping and rmap updates can corrupt page tables and VMA metadata, providing memory corruption primitives that can be developed into arbitrary kernel writes and control-flow hijacking.\nA:H - The mmap_lock violation can cause kernel oopses, panics, or hung memory management from inconsistent page tables and invalid VMA access during concurrent unmap operations."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "317460317a02a1af512697e6e964298dedd8a163", "lessThan": "36b1d997866f6083d33934983aa2ce0a184ed642", "versionType": "git"}, {"status": "affected", "version": "317460317a02a1af512697e6e964298dedd8a163", "lessThan": "80b89d0226a05e8b67969de99c31b51fcd54f76a", "versionType": "git"}], "programFiles": ["kernel/bpf/arena.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"status": "unaffected", "version": "0", "lessThan": "6.9", "versionType": "semver"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/bpf/arena.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/36b1d997866f6083d33934983aa2ce0a184ed642"}, {"url": "https://git.kernel.org/stable/c/80b89d0226a05e8b67969de99c31b51fcd54f76a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Take mmap_lock in zap_pages()\n\nzap_vma_range() requires the owning mm's mmap_lock to be held.\n\nTaking mmap_read_lock under arena->lock would AB-BA against\narena_vm_close() and arena_map_mmap(), both of which run with\nmmap_write_lock held and then acquire arena->lock. Instead drop\narena->lock, mmget_not_zero() the vma's mm, take mmap_read_lock, and\nre-resolve the vma via find_vma() since it may have been unmapped or\nreplaced while waiting.\n\nTrack processed vmls with a per-call generation in vml->zap_gen and\nserialize zap_pages() callers with a new arena->zap_mutex so\nconcurrent callers on different uaddr ranges do not mark each other's\nvmls processed before the zap is done."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:46:14.991Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74354", "state": "PUBLISHED", "dateUpdated": "2026-10-16T18:55:34.866Z", "dateReserved": "2026-08-15T05:44:03.887Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:58:40.067Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/arena.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "36b1d997866f6083d33934983aa2ce0a184ed642", "status": "affected", "version": "317460317a02a1af512697e6e964298dedd8a163", "versionType": "git"}, {"lessThan": "80b89d0226a05e8b67969de99c31b51fcd54f76a", "status": "affected", "version": "317460317a02a1af512697e6e964298dedd8a163", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/arena.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Take mmap_lock in zap_pages()\n\nzap_vma_range() requires the owning mm's mmap_lock to be held.\n\nTaking mmap_read_lock under arena->lock would AB-BA against\narena_vm_close() and arena_map_mmap(), both of which run with\nmmap_write_lock held and then acquire arena->lock. Instead drop\narena->lock, mmget_not_zero() the vma's mm, take mmap_read_lock, and\nre-resolve the vma via find_vma() since it may have been unmapped or\nreplaced while waiting.\n\nTrack processed vmls with a per-call generation in vml->zap_gen and\nserialize zap_pages() callers with a new arena->zap_mutex so\nconcurrent callers on different uaddr ranges do not mark each other's\nvmls processed before the zap is done."}], "id": "CVE-2026-74354", "lastModified": "2026-10-16T19:17:41.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74354", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:54:18.946852Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:36.773", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/36b1d997866f6083d33934983aa2ce0a184ed642"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/80b89d0226a05e8b67969de99c31b51fcd54f76a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: Take mmap_lock in zap_pages()", "id": "2516793", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516793"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-833", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Take mmap_lock in zap_pages()\nzap_vma_range() requires the owning mm's mmap_lock to be held.\nTaking mmap_read_lock under arena->lock would AB-BA against\narena_vm_close() and arena_map_mmap(), both of which run with\nmmap_write_lock held and then acquire arena->lock. Instead drop\narena->lock, mmget_not_zero() the vma's mm, take mmap_read_lock, and\nre-resolve the vma via find_vma() since it may have been unmapped or\nreplaced while waiting.\nTrack processed vmls with a per-call generation in vml->zap_gen and\nserialize zap_pages() callers with a new arena->zap_mutex so\nconcurrent callers on different uaddr ranges do not mark each other's\nvmls processed before the zap is done.", "A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. A local attacker could exploit a locking issue within the `zap_pages()` function. This vulnerability arises because `zap_vma_range()` requires a specific memory map lock (`mmap_lock`) that, when acquired under certain conditions, can lead to a deadlock. This deadlock can cause the system to become unresponsive, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-74354", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74354\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74354\nhttps://lore.kernel.org/linux-cve-announce/2026081500-CVE-2026-74354-67c4@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[317460317a02a1af512697e6e964298dedd8a163,36b1d997866f6083d33934983aa2ce0a184ed642)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[317460317a02a1af512697e6e964298dedd8a163,80b89d0226a05e8b67969de99c31b51fcd54f76a)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T13:00:05.627735+00:00", "updated": "2026-08-22T03:00:12.234827+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}