CVE-2026-74335 - Vulnerability Details

- bpf: Fix NULL pointer dereference in bpf_task_from_vpid()

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix NULL pointer dereference in bpf_task_from_vpid()

bpf_task_from_vpid() looks up a task in the pid namespace of the
current task, via find_task_by_vpid():

find_task_by_vpid(vpid)
find_task_by_pid_ns(vpid, task_active_pid_ns(current))
find_pid_ns(nr, ns) -> idr_find(&ns->idr, nr)

cgroup_skb programs run in softirq, which may interrupt a task that is
itself in do_exit(). Once that task has passed
exit_notify() -> release_task() -> __unhash_process(), its thread_pid is
cleared, so task_active_pid_ns(current) returns NULL and find_pid_ns()
dereferences &NULL->idr:

BUG: kernel NULL pointer dereference, address: 0000000000000050
RIP: 0010:idr_find+0x11/0x30 lib/idr.c:176
Call Trace:
<IRQ>
find_pid_ns kernel/pid.c:370 [inline]
find_task_by_pid_ns+0x3b/0xe0 kernel/pid.c:485
bpf_task_from_vpid+0x5b/0x200 kernel/bpf/helpers.c:2916
bpf_prog_run_array_cg+0x17e/0x530 kernel/bpf/cgroup.c:81
__cgroup_bpf_run_filter_skb+0x12b/0x250 kernel/bpf/cgroup.c:1612
sk_filter_trim_cap+0x1dc/0x4c0 net/core/filter.c:148
tcp_v4_rcv+0x18d1/0x2200 net/ipv4/tcp_ipv4.c:2223
</IRQ>
<TASK>
do_exit+0xa63/0x1270 kernel/exit.c:1010
get_signal+0x141c/0x1530 kernel/signal.c:3037

Bail out when current has no pid namespace.

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability causes a NULL pointer dereference in the kernel’s bpf_task_from_vpid() helper when a BPF cgroup program runs in softirq while a task is exiting. The fault results in a kernel panic, which is a form of denial of service. The weakness is a classic NULL pointer dereference, identified as CWE‑476.

Affected Systems

The flaw affects all builds of the Linux kernel that include the vulnerable bpf_task_from_vpid() implementation. No specific vendor or version list is mentioned, so any system running a non‑patched kernel is potentially impacted. This includes all Linux distributions whose kernel package contains the vulnerable code.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score of <1% and the fact that the vulnerability is not listed in CISA KEV reduce the immediate threat, but a local attacker who can load BPF programs is able to trigger the fault. Based on the description, the attack vector requires local execution of a malicious BPF cgroup program during task termination, implying that only users with sufficient privileges (e.g., root or BPF loader capabilities) can exploit it.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`675c3596ff32c040d1dd2e28dd57e83e634b9f60`	affected	< b7474f4432dd9559ada03b01a8cd3472cd02c61d
`675c3596ff32c040d1dd2e28dd57e83e634b9f60`	affected	< a4c95b6221cb2972a94ed72663c09bd5b0b6dea4
`675c3596ff32c040d1dd2e28dd57e83e634b9f60`	affected	< 50dff00615522f3ec03449680ca23beb4cfc549c

Linux

affected

Version	Status	Constraints
`6.13`	affected	—
`0`	unaffected	< 6.13
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[675c3596ff32c040d1dd2e28dd57e83e634b9f60,b7474f4432dd9559ada03b01a8cd3472cd02c61d)`	affected	code_commit	—
`[675c3596ff32c040d1dd2e28dd57e83e634b9f60,a4c95b6221cb2972a94ed72663c09bd5b0b6dea4)`	affected	code_commit	—
`[675c3596ff32c040d1dd2e28dd57e83e634b9f60,50dff00615522f3ec03449680ca23beb4cfc549c)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.13`	affected	generic	—
`[0,6.13)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel update that includes the fix commit.
Restrict the ability to load BPF cgroup programs by disabling the corresponding kernel feature or applying a stricter policy such as seccomp or capability limits to prevent untrusted users from deploying BPF filters.
If immediate patching is not possible, enforce kernel module signing and remove unprivileged programmatic access to BPF loading functions so that only signed code or privileged users can load BPF programs.

Generated by OpenCVE AI on August 22, 2026 at 00:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00166.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/50dff00615522f3ec03449680ca23beb4cfc549c
https://git.kernel.org/stable/c/a4c95b6221cb2972a94ed72663c09bd5b0b6dea4
https://git.kernel.org/stable/c/b7474f4432dd9559ada03b01a8cd3472cd02c61d
https://lore.kernel.org/linux-cve-announce/2026081556-CVE-2026-74335-c71b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74335
https://www.cve.org/CVERecord?id=CVE-2026-74335

History

Fri, 21 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081556-CVE-2026-74335-c71b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74335 https://www.cve.org/CVERecord?id=CVE-2026-74335
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 15 Aug 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sat, 15 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_task_from_vpid() bpf_task_from_vpid() looks up a task in the pid namespace of the current task, via find_task_by_vpid(): find_task_by_vpid(vpid) find_task_by_pid_ns(vpid, task_active_pid_ns(current)) find_pid_ns(nr, ns) -> idr_find(&ns->idr, nr) cgroup_skb programs run in softirq, which may interrupt a task that is itself in do_exit(). Once that task has passed exit_notify() -> release_task() -> __unhash_process(), its thread_pid is cleared, so task_active_pid_ns(current) returns NULL and find_pid_ns() dereferences &NULL->idr: BUG: kernel NULL pointer dereference, address: 0000000000000050 RIP: 0010:idr_find+0x11/0x30 lib/idr.c:176 Call Trace: <IRQ> find_pid_ns kernel/pid.c:370 [inline] find_task_by_pid_ns+0x3b/0xe0 kernel/pid.c:485 bpf_task_from_vpid+0x5b/0x200 kernel/bpf/helpers.c:2916 bpf_prog_run_array_cg+0x17e/0x530 kernel/bpf/cgroup.c:81 __cgroup_bpf_run_filter_skb+0x12b/0x250 kernel/bpf/cgroup.c:1612 sk_filter_trim_cap+0x1dc/0x4c0 net/core/filter.c:148 tcp_v4_rcv+0x18d1/0x2200 net/ipv4/tcp_ipv4.c:2223 </IRQ> <TASK> do_exit+0xa63/0x1270 kernel/exit.c:1010 get_signal+0x141c/0x1530 kernel/signal.c:3037 Bail out when current has no pid namespace.
Title		bpf: Fix NULL pointer dereference in bpf_task_from_vpid()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/50dff00615522f3ec03449680ca23beb4cfc549c https://git.kernel.org/stable/c/a4c95b6221cb2972a94ed72663c09bd5b0b6dea4 https://git.kernel.org/stable/c/b7474f4432dd9559ada03b01a8cd3472cd02c61d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:58:27.148Z

Updated: 2026-08-17T05:17:26.885Z

Reserved: 2026-08-15T05:44:03.885Z

Link: CVE-2026-74335

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:34.393

Modified: 2026-08-17T06:19:27.990

Link: CVE-2026-74335

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74335 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T01:00:13Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object