CVE-2026-74364

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74364", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.887Z", "datePublished": "2026-08-15T05:58:46.926Z", "dateUpdated": "2026-08-17T05:46:23.107Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:46:23.107Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject exclusive maps as inner maps in map-in-map\n\nAn exclusive map (created with excl_prog_hash) is bound to a single\nprogram by hash: check_map_prog_compatibility() refuses to load any\nprogram whose digest does not match map->excl_prog_sha. That check\nonly runs for maps a program references directly, i.e. its used_maps.\nA map reached at runtime through a map-of-maps is never in used_maps,\nand bpf_map_meta_equal() does not consider excl_prog_sha, so an\nexclusive map can be inserted into a non-exclusive outer map and\nthen looked up and mutated by an unrelated program, bypassing the\nexclusivity guarantee.\n\nFor the signed loader this defeats the metadata map exclusivity check\nadded in the signed loader: the cached map->sha[] is validated against\nthe signed hash while another program on a hostile host rewrites the\nfrozen map's contents through the outer map."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is reached only through bpf(2) syscalls (BPF_MAP_CREATE, BPF_MAP_UPDATE_ELEM, BPF_PROG_LOAD) and runtime BPF helpers on map-in-map structures, which per kernel guidance is a local attack vector.\nAC:L - Exploitation is a reliable, attacker-controlled sequence (create outer map-of-maps, insert exclusive inner map FD, load program referencing only outer map, lookup/mutate inner map) with no races or layout dependencies.\nPR:L - Triggering the vulnerable map-in-map paths requires local BPF privileges (typically CAP_BPF); per kernel guidance this is Low because CAP_BPF can be obtained by unprivileged users via user namespaces, not only init-namespace root.\nUI:N - No victim interaction is required; a local attacker with BPF access can create the outer map, insert the exclusive inner map, and mutate it through an unrelated loaded program without actions by other users.\nS:U - The impact is bypass of BPF exclusive-map and signed-loader integrity controls within the kernel BPF subsystem, not crossing a VM, container-to-host, or IOMMU security boundary.\nC:H - An unrelated BPF program can bpf_map_lookup_elem() an exclusive inner map via map-in-map indirection and read its full contents, including signed metadata and hashes that must remain confidential to unauthorized programs.\nI:H - The same indirection allows bpf_map_update_elem() on an exclusive map bound to a different program digest, defeating exclusivity and enabling rewrite of signed-loader metadata (map->sha[]) and other protected map state.\nA:N - This is an access-control bypass without memory corruption, use-after-free, or kernel panic; exploitation does not inherently cause crashes, hangs, or denial of kernel availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/map_in_map.c"], "versions": [{"version": "baefdbdf6812e120c9fba9cfb101d3656f478026", "lessThan": "3a0f73d27a8d379a8852a378b3c3208143e3b3b2", "status": "affected", "versionType": "git"}, {"version": "baefdbdf6812e120c9fba9cfb101d3656f478026", "lessThan": "7c58ace08f180f8e249e714d1623388362f9d807", "status": "affected", "versionType": "git"}, {"version": "baefdbdf6812e120c9fba9cfb101d3656f478026", "lessThan": "9a3c3c49c333760c8944dadacbe114c1884546ef", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/map_in_map.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3a0f73d27a8d379a8852a378b3c3208143e3b3b2"}, {"url": "https://git.kernel.org/stable/c/7c58ace08f180f8e249e714d1623388362f9d807"}, {"url": "https://git.kernel.org/stable/c/9a3c3c49c333760c8944dadacbe114c1884546ef"}], "title": "bpf: Reject exclusive maps as inner maps in map-in-map", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/map_in_map.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3a0f73d27a8d379a8852a378b3c3208143e3b3b2", "status": "affected", "version": "baefdbdf6812e120c9fba9cfb101d3656f478026", "versionType": "git"}, {"lessThan": "7c58ace08f180f8e249e714d1623388362f9d807", "status": "affected", "version": "baefdbdf6812e120c9fba9cfb101d3656f478026", "versionType": "git"}, {"lessThan": "9a3c3c49c333760c8944dadacbe114c1884546ef", "status": "affected", "version": "baefdbdf6812e120c9fba9cfb101d3656f478026", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/map_in_map.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject exclusive maps as inner maps in map-in-map\n\nAn exclusive map (created with excl_prog_hash) is bound to a single\nprogram by hash: check_map_prog_compatibility() refuses to load any\nprogram whose digest does not match map->excl_prog_sha. That check\nonly runs for maps a program references directly, i.e. its used_maps.\nA map reached at runtime through a map-of-maps is never in used_maps,\nand bpf_map_meta_equal() does not consider excl_prog_sha, so an\nexclusive map can be inserted into a non-exclusive outer map and\nthen looked up and mutated by an unrelated program, bypassing the\nexclusivity guarantee.\n\nFor the signed loader this defeats the metadata map exclusivity check\nadded in the signed loader: the cached map->sha[] is validated against\nthe signed hash while another program on a hostile host rewrites the\nfrozen map's contents through the outer map."}], "id": "CVE-2026-74364", "lastModified": "2026-08-17T06:19:31.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:38.037", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3a0f73d27a8d379a8852a378b3c3208143e3b3b2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7c58ace08f180f8e249e714d1623388362f9d807"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9a3c3c49c333760c8944dadacbe114c1884546ef"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: Reject exclusive maps as inner maps in map-in-map", "id": "2516758", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516758"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-551", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Reject exclusive maps as inner maps in map-in-map\nAn exclusive map (created with excl_prog_hash) is bound to a single\nprogram by hash: check_map_prog_compatibility() refuses to load any\nprogram whose digest does not match map->excl_prog_sha. That check\nonly runs for maps a program references directly, i.e. its used_maps.\nA map reached at runtime through a map-of-maps is never in used_maps,\nand bpf_map_meta_equal() does not consider excl_prog_sha, so an\nexclusive map can be inserted into a non-exclusive outer map and\nthen looked up and mutated by an unrelated program, bypassing the\nexclusivity guarantee.\nFor the signed loader this defeats the metadata map exclusivity check\nadded in the signed loader: the cached map->sha[] is validated against\nthe signed hash while another program on a hostile host rewrites the\nfrozen map's contents through the outer map.", "A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. Exclusive maps, which are designed to be used by a single program, can be incorrectly inserted as inner maps within a map-in-map structure. This bypasses the intended security checks, allowing an unrelated program to modify the contents of an exclusive map. This vulnerability could enable a malicious actor to rewrite the contents of a frozen map, thereby undermining critical security guarantees."], "name": "CVE-2026-74364", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74364\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74364\nhttps://lore.kernel.org/linux-cve-announce/2026081502-CVE-2026-74364-1e36@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baefdbdf6812e120c9fba9cfb101d3656f478026,3a0f73d27a8d379a8852a378b3c3208143e3b3b2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baefdbdf6812e120c9fba9cfb101d3656f478026,7c58ace08f180f8e249f714d1623388362f9d807)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baefdbdf6812e120c9fba9cfb101d3656f478026,9a3c3c49c333760c8944dadacbe114c1884546ef)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T13:30:04.659512+00:00", "updated": "2026-08-22T00:45:05.347190+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}