SB2026081594 - Out-of-bounds write in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-74371)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the BPF_PROG_QUERY cgroup query handler when processing a user-supplied bpf_attr structure smaller than the revision field layout. A local user can invoke BPF_PROG_QUERY with a specially crafted smaller attribute buffer to cause a denial of service.

The issue affects the cgroup attach type query path and does not apply to tcx or netkit query handlers because those interfaces were introduced with the revision field already present.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/21c4b99b27f3f85b89256e81b3e997dec0a460d0
• https://git.kernel.org/stable/c/a7131340d0f95df9a541257dccab5d85e6bcdd2b
• https://git.kernel.org/stable/c/d3d630e8a7f3421bc2d204b87bdff35b4432a8e3