SB20260815165 - Improper access control in Linux kernel bpf

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260815165

SB20260815165 - Improper access control in Linux kernel bpf

Published: August 15, 2026

Security Bulletin ID SB20260815165
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper access control (CVE-ID: CVE-2026-74305)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to bypass intended cgroup storage compatibility checks.

The vulnerability exists due to improper access control in bpf prog-array compatibility checks when validating tail-call chains involving cgroup local storage. A local user can load a storage-less BPF program that performs tail calls to bridge between programs with incompatible storage cookies to bypass intended cgroup storage compatibility checks.

Exploitation requires the ability to load and use BPF programs that participate in tail-call chains.


Remediation

Install update from vendor's website.

References