CVE-2026-74344

A flaw was found in the BPF (Berkeley Packet Filter) subsystem of the Linux kernel. When freeing a BPF red-black tree root, the system could leave behind stale pointers in certain objects. If the memory address is reused, a subsequent operation could incorrectly access these stale pointers, leading to memory corruption. This issue could potentially cause system instability or a denial of service.

A stale bpf rbtree node state can remain after bpf_rb_root_free() detaches a root and drops objects from the copied tree. If a refcounted object survives the drop, its bpf_rb_node_kern can keep an owner pointer to the freed root and old rb tree linkage. If a later bpf_rb_root allocation reuses the same address, bpf_rbtree_remove() can pass the owner check and call rb_erase_cached() on stale linkage, creating a plausible UAF or tree corruption condition. For the CVSS the PR:L is used for the paranoid score because triggering requires local BPF program capability or an equivalent delegated BPF context rather than a remote network path. The issue is not network reachable. Impact is at least local denial of service and in the worst case may allow confidentiality or integrity impact due to kernel memory corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.