{"apiVersion":"1.0","identifier":"CVE-2026-74314","description":"In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpf_obj_free_fields() when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete operation. For tracing programs this can include NMI context, where referenced kptr destructors, uptr unpinning, and graph root destruction are not generally safe. Introduce bpf_obj_cancel_fields() for the reusable-value path. It only performs NMI-safe cleanup for timer, workqueue, and task_work fields. Fields that need full destruction are left attached to the recycled value and are destroyed by the final cleanup path instead. Switch array and hashtab update/delete/recycle paths to this cancel helper. Keep bpf_obj_free_fields() for final map destruction and for bpf_mem_alloc destructors. Preallocated hashtabs do not have allocator destructors, so teardown continues to walk the normal and extra elements and fully destroy their fields. This deliberately relaxes the eager-free semantics of map update/delete for special fields. Programs that relied on a recycled map slot becoming empty immediately after update/delete were relying on behavior that cannot be implemented safely from every BPF execution context without offloading arbitrary destructors. There is a chance this change breaks programs making assumptions regarding the eager freeing of fields. If so, we can relax semantics to cancellation only when irqs_disabled() is true in the future. However, theoretically, map values that get reused eagerly already have weaker guarantees as parallel users can recreate freed fields before the new element becomes visible again.","publishedAt":"2026-08-15T06:22:31","lastModifiedAt":"2026-08-17T06:19:25","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74314","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00129,"riskScore":0.79,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74314","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74314","en":"https://www.redsauce.net/en/cves/CVE-2026-74314","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74314","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74314","de":"https://www.redsauce.net/de/cves/CVE-2026-74314","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74314","el":"https://www.redsauce.net/el/cves/CVE-2026-74314"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74314"}}