CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-15 · updated 2026-10-16

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning htab with internal structs") moved inode cleanup from ->free_inode() into ->destroy_inode() to avoid sleeping in RCU context when calling bpf_any_put(). However this removed the RCU delay on freeing the inode itself and the cached symlink body (i_link), both of which can be accessed by RCU pathwalk (pick_link, may_lookup etc.). This causes a use-after-free when a concurrent unlinkat() drops the last inode reference and destroy_inode() frees the inode immediately, while another task is still walking the path in RCU mode and reads inode->i_opflags (offset +2) inside current_time() -> is_mgtime(). KASAN reports: BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313 Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags) The rules (per Al Viro): ->destroy_inode() called immediately, can sleep, use for blocking cleanup e.g. bpf_any_put() ->free_inode() called after RCU grace period, use for freeing inode and anything RCU-accessible e.g. i_link Fix: split the two concerns properly: - keep bpf_any_put() in bpf_destroy_inode() since it is blocking and needs to run promptly - introduce bpf_free_inode() to handle kfree(i_link) and free_inode_nonrcu() with proper RCU delay, preventing the UAF

Affected products

Linux kernel: from 5.15.195 before 5.15.212; from 6.1.157 before 6.1.178; from 6.6.113 before 6.6.145; from 6.12.54 before 6.12.97; from 6.17.4 before 6.18; 6.18 — fixed in 5.15.212, 6.1.178, 6.12.97, 6.18, 6.6.145, 7.2

How to fix

Upgrade to a fixed version: Linux kernel 5.15.212, 6.1.178, 6.12.97, 6.18. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-74363 or the next vulnerability affects your stack