Denial of Service Vulnerability in Linux Kernel Affecting BPF Functions

CVE-2026-74400

What is CVE-2026-74400?

A vulnerability in the Linux kernel affects the BPF functions, specifically bpf_set_dentry_xattr and bpf_remove_dentry_xattr. When a negative dentry is supplied, these functions attempt to lock an inode without ensuring it is non-NULL, potentially leading to a NULL pointer dereference. This oversight can trigger a system crash under certain conditions, especially if panic_on_warn is enabled. A patch has been implemented to add checks for NULL pointers to prevent this issue, ensuring the stability of the affected systems.

References