CVE-2026-74337

A flaw was found in the Linux kernel, specifically within the BPF (Berkeley Packet Filter) subsystem. This vulnerability allows NMI (Non-Maskable Interrupt) and tracepoint BPF programs to re-enter certain internal locks, known as LRU (Least Recently Used) locks, while they are already held. This re-entry creates a deadlock condition, which can cause the system to become unresponsive or hang, leading to a Denial of Service (DoS).

A moderate impact flaw was found in the Linux kernel BPF subsystem, affecting the kernel and kernel-rt components in Red Hat Enterprise Linux 7, 8, 9, and 10 as well as Red Hat In-Vehicle OS 2. NMI and tracepoint BPF programs can re-enter a per-CPU or global LRU lock that bpf_lru_pop_free()/bpf_lru_push_free() already hold on the same CPU, causing a self-deadlock that can leave the system unresponsive and result in a denial of service. Triggering this flaw requires local access with the ability to load and attach NMI or tracepoint BPF programs on the affected system. Red Hat rated this flaw Moderate severity (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because it impacts availability only, with no effect on confidentiality or integrity. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that release. Fixes for the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams are currently deferred to a future update; until a fix is released, the residual risk is limited to a local denial of service by an attacker able to attach the affected BPF program types.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.