CVE-2026-74337
Description
A flaw was found in the Linux kernel, specifically within the BPF (Berkeley Packet Filter) subsystem. This vulnerability allows NMI (Non-Maskable Interrupt) and tracepoint BPF programs to re-enter certain internal locks, known as LRU (Least Recently Used) locks, while they are already held. This re-entry creates a deadlock condition, which can cause the system to become unresponsive or hang, leading to a Denial of Service (DoS).
Statement
A moderate impact flaw was found in the Linux kernel BPF subsystem, affecting the kernel and kernel-rt components in Red Hat Enterprise Linux 7, 8, 9, and 10 as well as Red Hat In-Vehicle OS 2. NMI and tracepoint BPF programs can re-enter a per-CPU or global LRU lock that bpf_lru_pop_free()/bpf_lru_push_free() already hold on the same CPU, causing a self-deadlock that can leave the system unresponsive and result in a denial of service. Triggering this flaw requires local access with the ability to load and attach NMI or tracepoint BPF programs on the affected system. Red Hat rated this flaw Moderate severity (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because it impacts availability only, with no effect on confidentiality or integrity. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that release. Fixes for the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams are currently deferred to a future update; until a fix is released, the residual risk is limited to a local denial of service by an attacker able to attach the affected BPF program types.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
