CVE-2026-74335: bpf: Fix NULL pointer dereference in bpf_task_from_vpid()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix NULL pointer dereference in bpftaskfromvpid()
bpftaskfromvpid() looks up a task in the pid namespace of the current task, via findtaskbyvpid():
findtaskbyvpid(vpid) findtaskbypidns(vpid, taskactivepidns(current)) findpidns(nr, ns) -> idrfind(&ns->idr, nr)
cgroupskb programs run in softirq, which may interrupt a task that is itself in doexit(). Once that task has passed exitnotify() -> releasetask() -> unhashprocess(), its threadpid is cleared, so taskactivepidns(current) returns NULL and findpidns() dereferences &NULL->idr:
BUG: kernel NULL pointer dereference, address: 0000000000000050 RIP: 0010:idrfind+0x11/0x30 lib/idr.c:176 Call Trace: <IRQ> findpidns kernel/pid.c:370 [inline] findtaskbypidns+0x3b/0xe0 kernel/pid.c:485 bpftaskfromvpid+0x5b/0x200 kernel/bpf/helpers.c:2916 bpfprogrunarraycg+0x17e/0x530 kernel/bpf/cgroup.c:81 cgroupbpfrunfilterskb+0x12b/0x250 kernel/bpf/cgroup.c:1612 skfiltertrimcap+0x1dc/0x4c0 net/core/filter.c:148 tcpv4rcv+0x18d1/0x2200 net/ipv4/tcpipv4.c:2223 </IRQ> <TASK> doexit+0xa63/0x1270 kernel/exit.c:1010 getsignal+0x141c/0x1530 kernel/signal.c:3037
Bail out when current has no pid namespace.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74335?
CVE-2026-74335 has a risk score of 33, indicating a moderate severity level.
What is the nature of the vulnerability in CVE-2026-74335?
CVE-2026-74335 involves a NULL pointer dereference in the bpf_task_from_vpid() function of the Linux kernel.
How do I fix CVE-2026-74335?
To fix CVE-2026-74335, you need to apply the latest updates to the Linux kernel that address this vulnerability.
What versions of the Linux kernel are affected by CVE-2026-74335?
Affected versions of the Linux kernel include those that have not been updated since the vulnerability was published on August 15, 2026.
Can CVE-2026-74335 be exploited remotely?
CVE-2026-74335 is generally not exploitable remotely as it requires local access to the system to trigger the NULL pointer dereference.