CVE-2026-74363 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, System administrators and users of Linux-based systems, Security teams and vulnerability management teams, Operators and platform teams responsible for Linux-based infrastructure, Security researchers and analysts focused on Linux kernel security

Why it matters

A use-after-free vulnerability in the Linux kernel's bpffs subsystem can lead to potential system crashes, elevation of privileges, denial of service, and data integrity issues if exploited.

• Potential system crash due to use-after-free error
• Elevation of privileges may be possible if exploited
• Denial of service (DoS) may occur if exploited
• Data integrity may be compromised if exploited

Technical summary

The vulnerability is caused by a use-after-free error in the bpffs subsystem of the Linux kernel. When a concurrent unlinkat() drops the last inode reference and destroy_inode() frees the inode immediately, another task walking the path in RCU mode can read inode->i_opflags, leading to a potential crash. The issue arises from a commit that moved inode cleanup from ->free_inode() into ->destroy_inode(), removing the RCU delay on freeing the inode itself and the cached symlink body. The vulnerability can cause system crashes, elevation of privileges, denial of service, and data integrity issues if exploited.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to fix the vulnerability
• Update Linux kernel to a version that includes the fix
• Monitor system logs for potential exploitation attempts
• Perform a thorough review of the system for potential exposure
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was introduced by a commit that moved inode cleanup from ->free_inode() into ->destroy_inode(). This change removed the RCU delay on freeing the inode itself and the cached symlink body, which can be accessed by RCU pathwalk. The issue was identified through code review and analysis of the Linux kernel's bpffs subsystem.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.