CVE-2026-74371

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat

BPF_PROG_QUERY writes back the 'query.revision' field unconditionally to

userspace. If userspace passes a smaller 'bpf_attr' structure (e.g. 40

bytes, which was the layout before the addition of 'query.revision'),

the kernel performs an out-of-bounds write.

Fix this by propagating the user-provided attribute size 'uattr_size'

down to the cgroup query handlers, and conditionally skipping writing

the revision field to userspace when the provided buffer size is

insufficient.

query.revision in bpf_mprog_query is structurally identical to the

cgroup case: a late tail field, written unconditionally.

But the backward-compat hazard is not the same.

The min-historical-size test is per command, and bpf_mprog_query only

serves attach types that were born with revision in the struct:

- tcx_prog_query -> BPF_TCX_INGRESS/EGRESS

- netkit_prog_query -> BPF_NETKIT_PRIM

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References