CVE-2026-74354

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. A local attacker could exploit a locking issue within the zap_pages() function. This vulnerability arises because zap_vma_range() requires a specific memory map lock (mmap_lock) that, when acquired under certain conditions, can lead to a deadlock. This deadlock can cause the system to become unresponsive, resulting in a Denial of Service (DoS).

A flaw of moderate impact was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem, in the BPF arena memory management code shipped in Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS. The zap_pages() function calls zap_vma_range() without holding the owning mm's mmap_lock, and taking the lock in that context can create an AB-BA deadlock against arena_vm_close() and arena_map_mmap(), which run with mmap_write_lock held and then acquire arena->lock. A local attacker able to use BPF arena mappings could trigger this locking error to deadlock the kernel, leaving the system unresponsive and causing a denial of service. Red Hat rates this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because it requires local access and affects only availability; this is lower than the upstream CVE record's Important rating of 7.8, which also claims confidentiality and integrity impact. The vulnerable BPF arena code was introduced with the bpf_arena feature and is not present in Red Hat Enterprise Linux 6, 7, 8, or the RHEL 9.2 and 9.4 update streams, so those products are not affected. For the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams, the fix is deferred to a future planned update rather than an immediate erratum; until a fixed kernel is available, the residual risk is that a local user with access to BPF arena functionality could hang the kernel, resulting in denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.