CVE-2026-74335

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix NULL pointer dereference in bpf_task_from_vpid()

bpf_task_from_vpid() looks up a task in the pid namespace of the

current task, via find_task_by_vpid():

find_task_by_vpid(vpid)

find_task_by_pid_ns(vpid, task_active_pid_ns(current))

find_pid_ns(nr, ns) -> idr_find(&ns->idr, nr)

cgroup_skb programs run in softirq, which may interrupt a task that is

itself in do_exit(). Once that task has passed

exit_notify() -> release_task() -> __unhash_process(), its thread_pid is

cleared, so task_active_pid_ns(current) returns NULL and find_pid_ns()

dereferences &NULL->idr:

BUG: kernel NULL pointer dereference, address: 0000000000000050

RIP: 0010:idr_find+0x11/0x30 lib/idr.c:176

Call Trace:

<IRQ>

find_pid_ns kernel/pid.c:370 [inline]

find_task_by_pid_ns+0x3b/0xe0 kernel/pid.c:485

bpf_task_from_vpid+0x5b/0x200 kernel/bpf/helpers.c:2916

bpf_prog_run_array_cg+0x17e/0x530 kernel/bpf/cgroup.c:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References