CVE-2026-74590 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
The BPF verifier and the dynptr abstraction ensure that the memory space referenced by a dynptr remains valid. They do not, however, provide any guarantee that the contents of the memory are stable. kfuncs are expected to remain memory-safe even if concurrent modifications occur.
bpf_get_fsverity_digest() didn't follow that: it could crash if arg->digest_size was concurrently modified.
Fix that by using the known-good value hash_alg->digest_size instead.
Also widen 'dynptr_sz' and 'out_digest_sz' to u64 to match the return type of __bpf_dynptr_size(). It doesn't appear that it can actually be more than INT_MAX currently (since __bpf_dynptr_data_rw() excludes file-based pointers), but the correct type might as well be used.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel vulnerability identified in fsverity involves a race condition within the bpf_get_fsverity_digest function, which is part of the BPF filesystem verification subsystem. This issue stems from an incorrect assumption regarding memory stability when interacting with dynamic pointers managed by the eBPF verifier and dynptr abstraction layer. While these mechanisms guarantee that the memory space referenced by a dynptr remains valid throughout its lifecycle, they do not ensure that the contents within that memory are stable or immutable during concurrent access. The kernel's kfuncs, including those used for filesystem verification, must maintain memory safety even in the presence of concurrent modifications to avoid undefined behavior or system crashes.
The specific technical flaw lies in how bpf_get_fsverity_digest handles the digest size parameter. Previously, the function relied on a value passed as an argument, arg->digest_size, which could be subject to race conditions if modified concurrently by other kernel processes or threads. This lack of atomicity meant that if the underlying data structure changed between the time the pointer was validated and the time it was accessed, the function could read inconsistent or corrupted values, leading to a potential kernel panic or denial of service. By switching to use hash_alg->digest_size instead, which is derived from the algorithm configuration rather than mutable argument state, the code ensures that the size value remains consistent with the actual cryptographic operation being performed.
In addition to fixing the race condition, the patch addresses type consistency issues by widening dynptr_sz and out_digest_sz variables to u64. This change aligns these local variables with the return type of __bpf_dynptr_size(), ensuring proper data handling across different architectures and preventing potential truncation or sign-extension errors in edge cases. Although current implementation constraints likely prevent values from exceeding INT_MAX due to exclusions for file-based pointers, using the correct wider integer type is a defensive programming practice that enhances robustness against future changes or unexpected input ranges.
From a security classification perspective, this vulnerability aligns with CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization, as it involves a race condition on shared data structures without adequate synchronization mechanisms to prevent inconsistent reads. Furthermore, the exploitation of such kernel-level races can lead to system instability or privilege escalation scenarios, mapping loosely to ATT&CK techniques involving local resource manipulation and potential denial of service through system crash. The fix ensures that critical verification functions remain resilient against timing-based attacks or accidental concurrent modifications by other subsystems within the Linux kernel environment.
Mitigation for this issue primarily involves applying the upstream kernel patch that corrects the reference source from arg->digest_size to hash_alg->digest_size and updates variable types to u64. System administrators should ensure their systems are updated with the latest stable kernel versions containing this fix. For environments where immediate patching is not feasible, monitoring for unusual system crashes or BPF program failures related to filesystem verification can serve as an indicator of potential exploitation attempts. Maintaining strict access controls on eBPF programs and ensuring that only trusted applications interact with fsverity features further reduces the attack surface associated with this vulnerability class.