CVE-2026-74371

A flaw was found in the Linux kernel's BPF_PROG_QUERY functionality. A local attacker could exploit this by providing a specially crafted bpf_attr structure with an insufficient size. This could lead to an out-of-bounds write, a memory corruption vulnerability where data is written beyond its allocated memory area, potentially causing system instability or other impacts.

BPF_PROG_QUERY in the cgroup path can write the query.revision field past the end of a short user supplied bpf_attr buffer when an old pre revision layout is used. This is an out of bounds write to user memory through copy_to_user, not a write to kernel memory, so the directly supported impact is corruption of the calling process address space or backward compatibility breakage rather than kernel memory corruption. For the CVSS the PR:L is used for the paranoid case because some deployments delegate CAP_NET_ADMIN to containers, reduced capability root, or service accounts even though the normal base case requires administrative BPF network capability. The issue is local only and is not network reachable. Impact is limited confidentiality, limited integrity, and limited availability in the paranoid interpretation due to constrained userspace memory corruption. There is no strong evidence of kernel privilege escalation from this patch alone.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.