CVE-2026-74258

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. A missing bounds check when accessing user space data for uprobe_multi could allow a local attacker to read or write to memory outside of intended boundaries. This vulnerability can lead to information disclosure or potentially privilege escalation.

A moderate impact flaw was found in the Linux kernel BPF subsystem, affecting the kernel packages of Red Hat Enterprise Linux 9 (9.4 and later), Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2. When attaching a uprobe_multi (multi-uprobe) BPF link, the kernel read the user-supplied offset, reference-counter-offset, and cookie arrays with __get_user without first validating that the supplied user-space address ranges were valid, because the required access_ok bounds check was missing. A local attacker with the privileges needed to load BPF programs and attach uprobes (for example CAP_SYS_ADMIN, or delegated CAP_BPF/CAP_PERFMON capabilities in some deployments) could supply invalid user-space pointers, causing the kernel to read memory outside the intended boundaries and potentially disclose kernel data. Red Hat Product Security has rated this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access to an already-privileged BPF tracing interface rather than a network-reachable path; this differs from the upstream CVE rating of Important (CVSS 7.8), which assumes broader confidentiality, integrity, and availability impact. Red Hat Enterprise Linux 6, 7, and 8 (including ELS and z-streams) and Red Hat Enterprise Linux 9.2 are not affected because the multi-uprobe link code containing this flaw was introduced only in Red Hat Enterprise Linux 9.4 and later and is not present in those streams. For the affected streams the fix is currently deferred to a future scheduled kernel update; the residual risk is limited to local users who already hold the BPF and tracing privileges required to trigger the issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.