UBUNTU-CVE-2026-74344: High severity ubuntu/linux-hwe-edge vulnerability

Q: Which Ubuntu kernel packages are identified as affected?

The affected software list includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.

Q: What access does an attacker need to exploit this issue?

The supplied vector indicates local access, low attack complexity, no user interaction, and high privileges are required. The issue involves BPF red-black-tree objects that survive a root teardown and are later manipulated.

Q: What is the potential impact if exploitation succeeds?

The vector rates confidentiality, integrity, and availability impact as high. A stale BPF RB-tree node can pass an owner check after root-memory reuse and be erased using pointers associated with an old tree.

Q: How can the vulnerable state arise?

It can arise when bpf_rb_root_free() drops objects from a detached tree but a refcounted object survives. Before the fix, that surviving object's BPF RB-tree node could retain its old owner pointer and tree linkage, allowing unsafe later removal if a newly allocated root reuses the same address.

Published Aug 15, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear rb node linkage when freeing bpfrbroot bpfrbrootfree() detaches the root by copying the current rbrootcached and then replacing the live root with RBROOTCACHED. It then walks the copied root and drops each object contained in the tree. This leaves the rb node state intact while dropping the object. If the object is refcounted and survives the drop, its bpfrbnodekern still contains an owner pointer to the freed root and stale rb tree linkage. If a later bpfrbroot allocation reuses the same address, bpfrbtreeremove() can incorrectly pass the owner check and call rberasecached() on a node whose rb pointers belong to the old tree. Mirror the list draining behavior by marking nodes as busy while the root is being detached, then clear the rb node and release the owner before dropping the containing object. This makes surviving nodes unowned and safe to reject from remove or accept for a later add.

Affected Software

162 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm-6.8*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime-6.8*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-aws-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0<7.0.0-1017.17~24.04.1

7.0.0-1017.17~24.04.1

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0<7.0.0-1016.16~24.04.1

7.0.0-1016.16~24.04.1

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-hwe-7.0<7.0.0-38.38~24.04.4

7.0.0-38.38~24.04.4

ubuntu/linux-ibm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-7.0<7.0.0-1024.25~24.04.1

7.0.0-1024.25~24.04.1

ubuntu/linux-nvidia-lowlatency*

ubuntu/linux-nvidia-tegra<6.8.0-1036.39

6.8.0-1036.39

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0<7.0.0-1013.13~24.04.1

7.0.0-1013.13~24.04.1

ubuntu/linux-raspi*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-38.38.1~24.04.1

7.0.0-38.38.1~24.04.1

ubuntu/linux-vmware*

ubuntu/linux-xilinx*

ubuntu/linux-bluefield*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<7.0.0-38.38

7.0.0-38.38

ubuntu/linux-aws<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-azure<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-azure-fde<7.0.0-1016.16

7.0.0-1016.16

ubuntu/linux-gcp<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-gke<7.0.0-1008.9

7.0.0-1008.9

ubuntu/linux-ibm<7.0.0-1015.15

7.0.0-1015.15

ubuntu/linux-nvidia<7.0.0-1025.26

7.0.0-1025.26

ubuntu/linux-nvidia-bos<7.0.0-2022.23

7.0.0-2022.23

ubuntu/linux-oem-7.0<7.0.0-1015.15

7.0.0-1015.15

ubuntu/linux-oracle<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-raspi<7.0.0-1023.23

7.0.0-1023.23

ubuntu/linux-realtime<7.0.0-38.38.1

7.0.0-38.38.1

ubuntu/linux-riscv<7.0.0-38.38.1

7.0.0-38.38.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38~24.04.4
Upgrade
Upgrade ubuntu/linux-nvidia-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1024.25~24.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1036.39
Upgrade
Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1~24.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 7.0.0-1008.9
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.15
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 7.0.0-1025.26
Upgrade
Upgrade ubuntu/linux-nvidia-bos to a version that resolves this vulnerability.
Fixed in 7.0.0-2022.23
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.15
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 7.0.0-1023.23
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1

Event History

Aug 15, 2026

CVE Published

via OSV·06:22 AM

Data Sourced

via OSV·06:22 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Ubuntu kernel packages are identified as affected?

The affected software list includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.

What access does an attacker need to exploit this issue?

The supplied vector indicates local access, low attack complexity, no user interaction, and high privileges are required. The issue involves BPF red-black-tree objects that survive a root teardown and are later manipulated.

What is the potential impact if exploitation succeeds?

The vector rates confidentiality, integrity, and availability impact as high. A stale BPF RB-tree node can pass an owner check after root-memory reuse and be erased using pointers associated with an old tree.

How can the vulnerable state arise?

It can arise when bpf_rb_root_free() drops objects from a detached tree but a refcounted object survives. Before the fix, that surviving object's BPF RB-tree node could retain its old owner pointer and tree linkage, allowing unsafe later removal if a newly allocated root reuses the same address.

UBUNTU-CVE-2026-74344: High severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Ubuntu kernel packages are identified as affected?

What access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

How can the vulnerable state arise?

Company

Resources

Contact