CVE-2026-74360

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. The bpf_map_elem iterator does not properly enforce exclusivity checks for certain maps, allowing it to bind to an exclusive map. This oversight exposes the map's value as a writable buffer. A local attacker could leverage this to perform unauthorized modifications to data within these exclusive maps, potentially leading to privilege escalation or information disclosure.

A moderate-impact flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 (kernel-rt in 9.6, and kernel and kernel-rt in 9.8 and 9.9), Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2. A bpf_map_elem iterator binds its target map at attach time in bpf_iter_attach_map() instead of referencing it from a BPF program, so the exclusivity check enforced by check_map_prog_compatibility() is never reached. As a result, the iterator can attach to an exclusive map (excl_prog_hash), which is intended to be reachable only from the single program whose hash matches, and it exposes the map's value as a writable buffer. A local attacker with the ability to load BPF programs and attach BPF iterators could exploit this to make unauthorized modifications to data in exclusive maps, potentially disrupting the kernel components that rely on them (Red Hat CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 6, 7, and 8, the RHEL 9.2 and 9.4 kernel and kernel-rt, and the RHEL 9.6 kernel are not affected because the exclusive map functionality that introduced this flaw is not present in those kernels. The fix for the affected streams is currently deferred and is planned to be delivered in a future update; the residual risk is limited because exploitation requires local access to the system together with the privileges needed to load BPF programs and attach BPF iterators.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.