Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-74363

bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning htab with internal structs") moved inode cleanup from ->free_inode() into ->destroy_inode() to avoid sleeping in RCU context when calling bpf_any_put(). However this removed the RCU delay on freeing the inode itself and the cached symlink body (i_link), both of which can be accessed by RCU pathwalk (pick_link, may_lookup etc.). This causes a use-after-free when a concurrent unlinkat() drops the last inode reference and destroy_inode() frees the inode immediately, while another task is still walking the path in RCU mode and reads inode->i_opflags (offset +2) inside current_time() -> is_mgtime(). KASAN reports: BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313 Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags) The rules (per Al Viro): ->destroy_inode() called immediately, can sleep, use for blocking cleanup e.g. bpf_any_put() ->free_inode() called after RCU grace period, use for freeing inode and anything RCU-accessible e.g. i_link Fix: split the two concerns properly: - keep bpf_any_put() in bpf_destroy_inode() since it is blocking and needs to run promptly - introduce bpf_free_inode() to handle kfree(i_link) and free_inode_nonrcu() with proper RCU delay, preventing the UAF

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • e28616ca3d67e745ecb2f10eba4a626e1fc9a203 to < ea1c243c39e32b7fc1c2edfe32081ff7e30a877caffected
  • 743a620c661994c7f0938e6dd32fb0883fb1e0ea to < 5fecb71c10c28aef276ba49c718dc961745fdcf0affected
  • b6e9645be9eb93f7aff3ca887f8edb6f1d63358f to < c70d0f9114c3cc156f6029a400c4eb7e6f7c82b2affected
  • ee04cff9ed4d6bb25802f5cecfcd0750500410f3 to < 53649846e0437d1d9b7cb993cfe54c367addf7aeaffected
  • 4f375ade6aa9f37fd72d7a78682f639772089eed to < 61f19729728243c82476dee31315143ed3275e7faffected
  • 4f375ade6aa9f37fd72d7a78682f639772089eed to < 0497ff765746d9b2d17445c8f7cc737b36c0152aaffected
  • 4f375ade6aa9f37fd72d7a78682f639772089eed to < b93c55b4932dd7e32dca8cf34a3443cc87a02906affected
  • de2d2baecc84cc7fca52eec2b9b55d89c93e3565affected
  • 5.15.195 to < 5.15.212affected
  • 6.1.157 to < 6.1.178affected
  • 6.6.113 to < 6.6.145affected
  • 6.12.54 to < 6.12.97affected
  • 6.17.4 to < 6.18affected

Linux Linux

Default version status: affected

  • 6.18affected
  • 0 to < 6.18unaffected
  • 5.15.212 to ≤ 5.15.*unaffected
  • 6.1.178 to ≤ 6.1.*unaffected
  • 6.6.145 to ≤ 6.6.*unaffected
  • 6.12.97 to ≤ 6.12.*unaffected
  • 6.18.40 to ≤ 6.18.*unaffected
  • 7.1.5 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References