{"apiVersion":"1.0","identifier":"CVE-2026-74363","description":"In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 (-bpf: Avoid RCU context warning when unpinning htab with internal structs-) moved inode cleanup from ->free_inode() into ->destroy_inode() to avoid sleeping in RCU context when calling bpf_any_put(). However this removed the RCU delay on freeing the inode itself and the cached symlink body (i_link), both of which can be accessed by RCU pathwalk (pick_link, may_lookup etc.). This causes a use-after-free when a concurrent unlinkat() drops the last inode reference and destroy_inode() frees the inode immediately, while another task is still walking the path in RCU mode and reads inode->i_opflags (offset +2) inside current_time() -> is_mgtime(). KASAN reports: BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313 Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags) The rules (per Al Viro): ->destroy_inode() called immediately, can sleep, use for blocking cleanup e.g. bpf_any_put() ->free_inode() called after RCU grace period, use for freeing inode and anything RCU-accessible e.g. i_link Fix: split the two concerns properly: - keep bpf_any_put() in bpf_destroy_inode() since it is blocking and needs to run promptly - introduce bpf_free_inode() to handle kfree(i_link) and free_inode_nonrcu() with proper RCU delay, preventing the UAF","publishedAt":"2026-08-15T06:22:37","lastModifiedAt":"2026-08-17T06:19:31","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74363","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00126,"riskScore":0.79,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74363","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74363","en":"https://www.redsauce.net/en/cves/CVE-2026-74363","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74363","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74363","de":"https://www.redsauce.net/de/cves/CVE-2026-74363","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74363","el":"https://www.redsauce.net/el/cves/CVE-2026-74363"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74363"}}