CVE-2026-74338

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. A local attacker could bypass security checks by directly using the bpf(2) system call to load a sleepable BPF_LSM_CGROUP program. This could lead to a kernel crash, resulting in a Denial of Service (DoS) on the affected system.

A flaw of low impact was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. The BPF verifier did not reject sleepable BPF programs intended for LSM cgroup attachment, even though the cgroup LSM shim runs under rcu_read_lock_dont_migrate(), a context in which sleeping is not allowed. A local attacker with the privileges required to load BPF programs could bypass libbpf by invoking the bpf(2) system call directly to load a BPF_F_SLEEPABLE BPF_LSM_CGROUP program, for example attached to the file_open hook, that calls a sleepable helper such as bpf_get_dentry_xattr(). This triggers a BUG for a sleeping function called from an invalid context, which can crash the kernel and result in a local denial of service. No confidentiality or integrity impact is established by the available evidence.

Red Hat Enterprise Linux 8 and earlier, including kernel-rt, are not affected because the vulnerable per-cgroup LSM BPF support was only introduced in later RHEL 9 streams and the vulnerable code is not present in those kernels. Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 are affected; the fix is currently deferred for these streams given the low assessed impact and because exploitation requires an already-privileged local user able to load BPF programs, leaving the residual risk limited to local denial of service.

The CVE.org record scores this flaw 7.8 (IMPORTANT, with high confidentiality, integrity, and availability impact). Red Hat rates it lower (CVSS 3.1 score 5.5, impact LOW) because successful exploitation requires local privileged access to load BPF programs and the demonstrated consequence is denial of service only.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.