CVE-2026-74363

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

commit 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning

htab with internal structs") moved inode cleanup from ->free_inode()

into ->destroy_inode() to avoid sleeping in RCU context when calling

bpf_any_put(). However this removed the RCU delay on freeing the

inode itself and the cached symlink body (i_link), both of which

can be accessed by RCU pathwalk (pick_link, may_lookup etc.).

This causes a use-after-free when a concurrent unlinkat() drops the

last inode reference and destroy_inode() frees the inode immediately,

while another task is still walking the path in RCU mode and reads

inode->i_opflags (offset +2) inside current_time() -> is_mgtime().

KASAN reports:

BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313

Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags)

The rules (per Al Viro):

->destroy_inode()

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References