CVE-2026-74335 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix NULL pointer dereference in bpf_task_from_vpid()
bpf_task_from_vpid() looks up a task in the pid namespace of the current task, via find_task_by_vpid():
find_task_by_vpid(vpid) find_task_by_pid_ns(vpid, task_active_pid_ns(current)) find_pid_ns(nr, ns) -> idr_find(&ns->idr, nr)
cgroup_skb programs run in softirq, which may interrupt a task that is itself in do_exit(). Once that task has passed exit_notify() -> release_task() -> __unhash_process(), its thread_pid is cleared, so task_active_pid_ns(current) returns NULL and find_pid_ns() dereferences &NULL->idr:
BUG: kernel NULL pointer dereference, address: 0000000000000050 RIP: 0010:idr_find+0x11/0x30 lib/idr.c:176 Call Trace: <IRQ> find_pid_ns kernel/pid.c:370 [inline]
find_task_by_pid_ns+0x3b/0xe0 kernel/pid.c:485 bpf_task_from_vpid+0x5b/0x200 kernel/bpf/helpers.c:2916 bpf_prog_run_array_cg+0x17e/0x530 kernel/bpf/cgroup.c:81 __cgroup_bpf_run_filter_skb+0x12b/0x250 kernel/bpf/cgroup.c:1612 sk_filter_trim_cap+0x1dc/0x4c0 net/core/filter.c:148 tcp_v4_rcv+0x18d1/0x2200 net/ipv4/tcp_ipv4.c:2223 </IRQ> <TASK> do_exit+0xa63/0x1270 kernel/exit.c:1010 get_signal+0x141c/0x1530 kernel/signal.c:3037
Bail out when current has no pid namespace.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical NULL pointer dereference in the Linux kernel's eBPF subsystem, specifically within the bpf_task_from_vpid() helper function. This issue arises from a race condition that occurs during the execution of cgroup_skb programs which operate in softirq context. The flaw demonstrates how seemingly isolated kernel components can interact in dangerous ways when process lifecycle management intersects with BPF program execution. When a task is in the process of exiting, it may be interrupted by a softirq that executes BPF code, creating an execution path where the thread_pid structure has already been cleared but the lookup process attempts to dereference a NULL pointer.
The technical root cause stems from how the kernel handles pid namespace lookups during task resolution. The bpf_task_from_vpid() function relies on find_task_by_vpid() which ultimately calls find_pid_ns() with the namespace obtained through task_active_pid_ns(current). During task exit, particularly after exit_notify() has called release_task() and __unhash_process(), the thread_pid is cleared, causing task_active_pid_ns(current) to return NULL. This NULL value then gets passed to find_pid_ns() which attempts to dereference the NULL->idr field, leading to the kernel NULL pointer dereference at idr_find(). The call trace clearly shows this execution path from the softirq context through the BPF helper function directly into the problematic kernel code.
This vulnerability has significant operational impact as it can lead to system crashes and potential denial of service conditions in environments running BPF programs, particularly those associated with cgroup networking controls. The race condition makes exploitation challenging but not impossible, especially in high-concurrency scenarios where process exits and softirq interruptions occur frequently. The issue affects kernel versions where BPF cgroup programs are enabled and actively used for network filtering or monitoring purposes, potentially compromising system stability in production environments.
The fix implemented addresses the core issue by adding a null check when determining if the current task has a valid pid namespace before proceeding with the lookup operations. This approach aligns with standard security practices for preventing NULL pointer dereferences and follows the principle of defensive programming. From an ATT&CK perspective, this represents a privilege escalation vector through kernel memory corruption, potentially enabling an attacker to gain elevated privileges or cause system instability. The vulnerability maps to CWE-476 which describes NULL pointer dereference conditions in software systems. Proper input validation and null checks in kernel space are essential to prevent such race condition scenarios, particularly when dealing with concurrent access patterns involving process lifecycle management and interrupt handling contexts.