CVE-2026-74371 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat
BPF_PROG_QUERY writes back the 'query.revision' field unconditionally to userspace. If userspace passes a smaller 'bpf_attr' structure (e.g. 40 bytes, which was the layout before the addition of 'query.revision'), the kernel performs an out-of-bounds write.
Fix this by propagating the user-provided attribute size 'uattr_size' down to the cgroup query handlers, and conditionally skipping writing the revision field to userspace when the provided buffer size is insufficient.
query.revision in bpf_mprog_query is structurally identical to the cgroup case: a late tail field, written unconditionally.
But the backward-compat hazard is not the same.
The min-historical-size test is per command, and bpf_mprog_query only serves attach types that were born with revision in the struct:
- tcx_prog_query -> BPF_TCX_INGRESS/EGRESS - netkit_prog_query -> BPF_NETKIT_PRIMARY/PEER
tcx, netkit, the revision field, and bpf_mprog_query itself all landed in the same v6.6 merge window (053c8e1f235d added the mprog query API + revision; tcx in e420bed02507, netkit in 35dfaad7188c). There has never been a tcx/netkit BPF_PROG_QUERY userspace that doesn't know about revision. So for these commands the minimum legitimate struct already covers offset 56-64 — no old binary can be broken here.
Contrast with cgroup: BPF_PROG_QUERY on cgroup attach types shipped in 2017; revision write-back was bolted on years later (120933984460). That path has a real population of pre-revision callers.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical out-of-bounds write condition in the Linux kernel's BPF (Berkeley Packet Filter) subsystem that specifically affects the BPF_PROG_QUERY functionality when dealing with cgroup-based program queries. This issue arises from an improper handling of backward compatibility between different versions of the bpf_attr structure, where the kernel unconditionally writes the 'query.revision' field to userspace regardless of the buffer size provided by the calling application. The problem manifests when older userspace applications pass a smaller bpf_attr structure that predates the addition of the revision field, leading to memory corruption through writes beyond the allocated buffer boundaries.
The technical flaw stems from the kernel's failure to properly validate the user-provided attribute size before performing write operations to the 'query.revision' field. This design oversight creates a condition where the cgroup query handlers receive no information about the actual buffer size available to the userspace application, resulting in unconditional writes that can overwrite adjacent memory locations. The vulnerability is particularly concerning because it affects the kernel's memory management and could potentially be exploited to execute arbitrary code or cause system instability. The issue follows CWE-787 (Out-of-bounds Write) and aligns with ATT&CK technique T1059.008 (Command and Scripting Interpreter: Python) through potential exploitation vectors that involve kernel memory corruption.
The operational impact of this vulnerability extends beyond immediate system crashes to include potential privilege escalation and denial of service conditions, especially in environments where BPF programs are extensively used for network filtering, monitoring, or security enforcement. The fix implemented addresses this by propagating the user-provided attribute size information through the cgroup query handlers and introducing conditional logic that skips the revision field write when the provided buffer is insufficient to accommodate it. This approach maintains backward compatibility while preventing memory corruption, though it requires careful handling of different command types and their historical evolution.
The vulnerability's complexity is further highlighted by the distinction between different BPF attachment types and their respective historical contexts. The tcx_prog_query and netkit_prog_query commands, which were introduced alongside the revision field in kernel version 6.6, do not present backward compatibility issues since no legacy userspace applications exist that would encounter this problem. However, cgroup-based BPF_PROG_QUERY operations, which have existed since 2017, face a genuine risk of breaking older implementations that predate the revision field addition in 2023. This distinction requires different handling approaches within the kernel codebase and demonstrates the challenges of maintaining compatibility across long-release cycles in complex kernel subsystems. The solution implements a per-command minimum historical size test to determine whether legacy callers could be affected, ensuring that only truly vulnerable paths receive the conditional write logic while preserving existing functionality for newer, properly updated applications.