CVE-2026-74314

Status: UPDATED  |  Advisory ID: CVE-2026-74314

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

bpf: Cancel special fields on map value recycle

Map update and delete paths currently call bpf_obj_free_fields() when a

value is being replaced or recycled. That makes field destruction depend

on the context of the update/delete operation. For tracing programs this

can include NMI context, where referenced kptr destructors, uptr

unpinning, and graph root destruction are not generally safe.

Introduce bpf_obj_cancel_fields() for the reusable-value path. It only

performs NMI-safe cleanup for timer, workqueue, and task_work fields.

Fields that need full destruction are left attached to the recycled value

and are destroyed by the final cleanup path instead.

Switch array and hashtab update/delete/recycle paths to this cancel

helper. Keep bpf_obj_free_fields() for final map destruction and for

bpf_mem_alloc destructors. Preallocated hashtabs do not have allocator

destructors, so teardown continues to walk the normal and extra elements

and fully destroy their fields.

This deliberately relaxes the eager-free semantics of map update/delete

for special fields. Programs that relied on a recycled map slot becoming

empty immediately after update/delete were relying on behavior that

cannot be implemented safely from every BPF execution context without

offloading arbitrary destructors.

There is a chance this change breaks programs making assumptions

regarding the eager freeing of fields. If so, we can relax semantics to

cancellation only when irqs_disabled() is true in the future. However,

theoretically, map values that get reused eagerly already have weaker

guarantees as parallel users can recreate freed fields before the new

element becomes visible again. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References