CVE-2026-74338 - Vulnerability Details

- bpf: Reject sleepable BPF_LSM_CGROUP programs at load time

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject sleepable BPF_LSM_CGROUP programs at load time

The cgroup shim runs under rcu_read_lock_dont_migrate(), so we should
not attach any sleepable BPF programs there. Add support to the verifier
to explicitly reject attempts to load sleepable BPF programs destined
for LSM cgroup attachment.

Without this, we get the following splat from a BPF_LSM_CGROUP
program marked BPF_F_SLEEPABLE attached to file_open when it calls
bpf_get_dentry_xattr():

BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1567
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 34317, name: load
preempt_count: 0, expected: 0
RCU nest depth: 2, expected: 0
Call Trace:
down_read+0x76/0x480
ext4_xattr_get+0x11f/0x700
__vfs_getxattr+0xf0/0x150
bpf_get_dentry_xattr+0xbb/0xf0
bpf_prog_e76a298dac9218c6_test_open+0x6a/0x85
__cgroup_bpf_run_lsm_current+0x326/0x840
bpf_trampoline_6442534646+0x62/0x14d
security_file_open+0x34/0x60
do_dentry_open+0x340/0x1260
vfs_open+0x7a/0x440
path_openat+0x1bac/0x30a0

libbpf provides a .s named section variant for every sleepable
program type except lsm_cgroup, reflecting that per-cgroup LSM programs
are intended to only run in a non-sleepable context.

The above splat was obtained by bypassing libbpf by using bpf(2)
directly.

Published: 2026-08-15

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A sleepable BPF_LSM_CGROUP program can be loaded into the kernel’s LSM cgroup attachment mechanism— a context that does not allow sleeping functions. When such a program calls a sleeping API it triggers a BUG, leading the kernel to crash. It is inferred that this crash could lead to a system reboot or halt, causing a denial of service. The vulnerability is caused by a missing verification step that should reject sleepable programs for LSM cgroup attachment.

Affected Systems

Linux kernel binaries are affected. No specific kernel version is listed in the CVE data, but the bad code resides in the BPF verifier used by the kernel’s LSM cgroup attachment mechanism. Therefore any Linux kernel that includes this verifier without the new rejection logic could be impacted, regardless of distribution or release line.

Risk and Exploitability

The CVSS score is 7.8, and the EPSS score is less than 1%, indicating a very low but nonzero probability of exploitation. The vulnerability can be exploited by a local actor with appropriate privileges; the primary risk is a service interruption due to a kernel crash (viable DoS). The fix, introduced by the commit referenced in the description, eliminates the code path that allows sleeping in a non‑sleepable context, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation at the time of reporting.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e`	affected	< be9eaf2bb5db4ad3de61ef739fd268fd7f135737
`69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e`	affected	< 5b038319be442c620f774e6fc9e9283deeca1c75

Linux

affected

Version	Status	Constraints
`6.0`	affected	—
`0`	unaffected	< 6.0
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e,be9eaf2bb5db4ad3de61ef739fd268fd7f135737)`	affected	code_commit	—
`[69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e,5b038319be442c620f774e6fc9e9283deeca1c75)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.0`	affected	generic	—
`[0,6.0)`	unaffected	generic	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a Linux kernel update that incorporates the commit fixing the rejection of sleepable BPF_LSM_CGROUP programs.
If an immediate kernel upgrade is not feasible, avoid loading BPF programs that set the BPF_F_SLEEPABLE flag into LSM cgroup contexts; use libbpf rather than the raw bpf(2) system call to rely on the verifier.
Restrict the ability to load BPF programs to users with the necessary administrative capabilities (e.g., CAP_SYS_ADMIN) and consider disabling LSM cgroup BPF program attachment if it is not required.

Generated by OpenCVE AI on August 22, 2026 at 02:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00128.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/5b038319be442c620f774e6fc9e9283deeca1c75
https://git.kernel.org/stable/c/be9eaf2bb5db4ad3de61ef739fd268fd7f135737
https://lore.kernel.org/linux-cve-announce/2026081557-CVE-2026-74338-0bff@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74338
https://www.cve.org/CVERecord?id=CVE-2026-74338

History

Sat, 22 Aug 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20 CWE-264 CWE-674

Thu, 20 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-663
References		https://lore.kernel.org/linux-cve-announce/2026081557-CVE-2026-74338-0bff@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74338 https://www.cve.org/CVERecord?id=CVE-2026-74338
Metrics	threat_severity `None`	threat_severity `Low`

Mon, 17 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-264 CWE-674

Mon, 17 Aug 2026 10:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-682

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 13:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-682

Sat, 15 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time The cgroup shim runs under rcu_read_lock_dont_migrate(), so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts to load sleepable BPF programs destined for LSM cgroup attachment. Without this, we get the following splat from a BPF_LSM_CGROUP program marked BPF_F_SLEEPABLE attached to file_open when it calls bpf_get_dentry_xattr(): BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1567 in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 34317, name: load preempt_count: 0, expected: 0 RCU nest depth: 2, expected: 0 Call Trace: down_read+0x76/0x480 ext4_xattr_get+0x11f/0x700 __vfs_getxattr+0xf0/0x150 bpf_get_dentry_xattr+0xbb/0xf0 bpf_prog_e76a298dac9218c6_test_open+0x6a/0x85 __cgroup_bpf_run_lsm_current+0x326/0x840 bpf_trampoline_6442534646+0x62/0x14d security_file_open+0x34/0x60 do_dentry_open+0x340/0x1260 vfs_open+0x7a/0x440 path_openat+0x1bac/0x30a0 libbpf provides a .s named section variant for every sleepable program type except lsm_cgroup, reflecting that per-cgroup LSM programs are intended to only run in a non-sleepable context. The above splat was obtained by bypassing libbpf by using bpf(2) directly.
Title		bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5b038319be442c620f774e6fc9e9283deeca1c75 https://git.kernel.org/stable/c/be9eaf2bb5db4ad3de61ef739fd268fd7f135737

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:58:29.222Z

Updated: 2026-08-17T05:46:05.052Z

Reserved: 2026-08-15T05:44:03.885Z

Link: CVE-2026-74338

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:34.740

Modified: 2026-08-17T06:19:28.243

Link: CVE-2026-74338

Redhat

Severity : Low

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74338 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T02:15:03Z

Weaknesses

CWE-663
Use of a Non-reentrant Function in a Concurrent Context

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object