CVE-2026-74314

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. This vulnerability arises from improper handling of special fields during the recycling of map values, which can lead to unsafe destruction operations. Specifically, in tracing programs operating within a Non-Maskable Interrupt (NMI) context, this resource management issue could result in unexpected system behavior or data integrity problems.

A moderate severity flaw was found in the Linux kernel BPF subsystem's handling of map value recycling. When a map value containing special fields such as referenced kptrs, user pointers, timers, workqueues, or graph roots is replaced or deleted, the update and delete paths performed full field destruction from the context of the triggering operation. For tracing programs this context can be NMI (non-maskable interrupt) context, where such destruction operations are not generally safe, which can result in warnings, lockups, or kernel crashes, i.e. a local denial of service. Exploiting this flaw requires local access and the ability to run BPF programs that use maps with these special fields, so the impact is limited to availability; Red Hat rates it Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the upstream CVE.org score of 7.8, because of the local, privileged access required and the availability-only consequence. Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS 2 contain the introducing change and are affected, with the fix currently deferred to a future release; until a fixed kernel is delivered, the residual risk is a local denial of service caused by a crafted BPF program triggering the unsafe cleanup. Red Hat Enterprise Linux 6, 7, and 8 do not contain the vulnerable code and are therefore not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.