From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0CCBB38423B for ; Sat, 15 Aug 2026 06:36:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775819; cv=none; b=TsfBwov6hBlnGNVYSWNJg/1TFKZwblp9V/LKCFIwh4WBk8yrJpbwZGLB1Dnqal7N79q9bcHHzzuc2gpLa8YS2pVOOgJfSdaZ3bdoFUHufjQniwITO3cSEoxmVVGMz+ftY2u/ygF4yVM+zIq3AKsMgHCDn6EQnTzAxSzpcIiQrf4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775819; c=relaxed/simple; bh=JD8wnubRMdfzdI9IrAKCAH8PGDnls2eYZRpgHKvcHmU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=h7NAFzTMOyKv0x02y+73+JHy1yEnGWtqwsYhq55e04WMTBDsq2RZ7Jshc6+4Agm/x9DCKNjW/dS1slRthJaGuzcK1TL4zdobzfNAzBdYcLnxQPlxNSmdy8AT+M6PRui0G5rA6WjhxafTTN9+C/JXdWGjUq68mIzMjq44vLNUXtU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=quCaJ+hi; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="quCaJ+hi" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1962D1F000E9; Sat, 15 Aug 2026 06:36:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786775817; bh=3rAvdYegIE+e/bxeS3nNyXURAvrpHTPM61FTyvoQ5nQ=; h=From:To:Cc:Subject:Date:Reply-To; b=quCaJ+hiqXUNu8x2mmXQy0XxXqw4kdbXW2TTx7frzbImHThZlqlF5IYfvXEp42Xxr uugCSkK4Tmbc9vS8D68M5nkm+Iu+U9fskQ+mAf/oQYtUsbA5xiwDXUZgsAbofPsioi 5fMCb9xmd35f8m6QouLOX/N1pe9a3MAURyr2T6ik= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs Date: Sat, 15 Aug 2026 15:11:30 +0900 Message-ID: <2026081501-CVE-2026-74363-e3cf@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4393; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=lIrugEsmf5w+ekJnQQeruzRhedDBLbiV0O7ZhhL2Yq8=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkNjGKG/DM2f706ebaaY0HP1fgdgmEO8ntKd/bqvc1e8 k7VP+BvRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAExkuxXDXPmbUa3bj9w7l7St e2EQR/kkXcONUxjmGR88au0KNDa56r+MJ2f2O8tLAmwA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning htab with internal structs") moved inode cleanup from ->free_inode() into ->destroy_inode() to avoid sleeping in RCU context when calling bpf_any_put(). However this removed the RCU delay on freeing the inode itself and the cached symlink body (i_link), both of which can be accessed by RCU pathwalk (pick_link, may_lookup etc.). This causes a use-after-free when a concurrent unlinkat() drops the last inode reference and destroy_inode() frees the inode immediately, while another task is still walking the path in RCU mode and reads inode->i_opflags (offset +2) inside current_time() -> is_mgtime(). KASAN reports: BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313 Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags) The rules (per Al Viro): ->destroy_inode() called immediately, can sleep, use for blocking cleanup e.g. bpf_any_put() ->free_inode() called after RCU grace period, use for freeing inode and anything RCU-accessible e.g. i_link Fix: split the two concerns properly: - keep bpf_any_put() in bpf_destroy_inode() since it is blocking and needs to run promptly - introduce bpf_free_inode() to handle kfree(i_link) and free_inode_nonrcu() with proper RCU delay, preventing the UAF The Linux kernel CVE team has assigned CVE-2026-74363 to this issue. Affected and fixed versions =========================== Issue introduced in 5.15.195 with commit e28616ca3d67e745ecb2f10eba4a626e1fc9a203 and fixed in 5.15.212 with commit ea1c243c39e32b7fc1c2edfe32081ff7e30a877c Issue introduced in 6.1.157 with commit 743a620c661994c7f0938e6dd32fb0883fb1e0ea and fixed in 6.1.178 with commit 5fecb71c10c28aef276ba49c718dc961745fdcf0 Issue introduced in 6.6.113 with commit b6e9645be9eb93f7aff3ca887f8edb6f1d63358f and fixed in 6.6.145 with commit c70d0f9114c3cc156f6029a400c4eb7e6f7c82b2 Issue introduced in 6.12.54 with commit ee04cff9ed4d6bb25802f5cecfcd0750500410f3 and fixed in 6.12.97 with commit 53649846e0437d1d9b7cb993cfe54c367addf7ae Issue introduced in 6.18 with commit 4f375ade6aa9f37fd72d7a78682f639772089eed and fixed in 6.18.40 with commit 61f19729728243c82476dee31315143ed3275e7f Issue introduced in 6.18 with commit 4f375ade6aa9f37fd72d7a78682f639772089eed and fixed in 7.1.5 with commit 0497ff765746d9b2d17445c8f7cc737b36c0152a Issue introduced in 6.18 with commit 4f375ade6aa9f37fd72d7a78682f639772089eed and fixed in 7.2-rc1 with commit b93c55b4932dd7e32dca8cf34a3443cc87a02906 Issue introduced in 6.17.4 with commit de2d2baecc84cc7fca52eec2b9b55d89c93e3565 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-74363 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: kernel/bpf/inode.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/ea1c243c39e32b7fc1c2edfe32081ff7e30a877c https://git.kernel.org/stable/c/5fecb71c10c28aef276ba49c718dc961745fdcf0 https://git.kernel.org/stable/c/c70d0f9114c3cc156f6029a400c4eb7e6f7c82b2 https://git.kernel.org/stable/c/53649846e0437d1d9b7cb993cfe54c367addf7ae https://git.kernel.org/stable/c/61f19729728243c82476dee31315143ed3275e7f https://git.kernel.org/stable/c/0497ff765746d9b2d17445c8f7cc737b36c0152a https://git.kernel.org/stable/c/b93c55b4932dd7e32dca8cf34a3443cc87a02906