CVE-2026-74314

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpf_obj_free_fields() when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete operation. For tracing programs this can include NMI context, where referenced kptr destructors, uptr unpinning, and graph root destruction are not generally safe. Introduce bpf_obj_cancel_fields() for the reusable-value path. It only performs NMI-safe cleanup for timer, workqueue, and task_work fields. Fields that need full destruction are left attached to the recycled value and are destroyed by the final cleanup path instead. Switch array and hashtab update/delete/recycle paths to this cancel helper. Keep bpf_obj_free_fields() for final map destruction and for bpf_mem_alloc destructors. Preallocated hashtabs do not have allocator destructors, so teardown continues to walk the normal and extra elements and fully destroy their fields. This deliberately relaxes the eager-free semantics of map update/delete for special fields. Programs that relied on a recycled map slot becoming empty immediately after update/delete were relying on behavior that cannot be implemented safely from every BPF execution context without offloading arbitrary destructors. There is a chance this change breaks programs making assumptions regarding the eager freeing of fields. If so, we can relax semantics to cancellation only when irqs_disabled() is true in the future. However, theoretically, map values that get reused eagerly already have weaker guarantees as parallel users can recreate freed fields before the new element becomes visible again.

• https://git.kernel.org/stable/c/9ea734e2cc0143d7429ab7dc0b20c85e5836183c
• https://git.kernel.org/stable/c/a3a81d247651218e47153f2d2afd7aee236726fd

Published

Aug 15, 2026

Last Modified

Aug 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-74309In the Linux kernel, the following vulnerability has been re…10
• CVE-2026-7431An incorrect permission assignment for critical resource of …4.4
• CVE-2026-74310In the Linux kernel, the following vulnerability has been re…9.3
• CVE-2026-74311In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-74312In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-74313In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-74315In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-74316In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-74317In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-74318In the Linux kernel, the following vulnerability has been re…
• CVE-2026-74319In the Linux kernel, the following vulnerability has been re…
• CVE-2026-7432A race condition in Ivanti Secure Access Client before 22.8R…7