Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-74371: Linux kernel BPF query can overwrite memory
CVE-2026-74371 · published 2 months ago
Summary
The BPF program query feature in the Linux kernel could write data beyond the space provided by older applications, potentially causing crashes or allowing malicious code execution. This problem affects Ubuntu kernel builds for GCP and GKE (versions 5.8 and 5.15). Install the latest kernel updates for these platforms to apply the fix.
What to do
- Update debian linux to version 7.1.5-1.
- Update linux kernel to version 7.1.5.
- Update canonical linux-aws-7.0 to version 7.0.0-1014.14~24.04.1.
- Update canonical linux-azure-7.0 to version 7.0.0-1017.17~24.04.1.
- Update canonical linux-azure-fde-7.0 to version 7.0.0-1016.16~24.04.1.
- Update canonical linux-gcp-7.0 to version 7.0.0-1014.14~24.04.1.
- Update canonical linux-hwe-7.0 to version 7.0.0-38.38~24.04.4.
- Update canonical linux-oracle-7.0 to version 7.0.0-1013.13~24.04.1.
- Update canonical linux to version 7.0.0-38.38.
- Update canonical linux-aws to version 7.0.0-1014.14.
- Update canonical linux-azure to version 7.0.0-1017.17.
- Update canonical linux-azure-fde to version 7.0.0-1016.16.
- Update canonical linux-gcp to version 7.0.0-1014.14.
- Update canonical linux-gke to version 7.0.0-1008.9.
- Update canonical linux-ibm to version 7.0.0-1015.15.
- Update canonical linux-oem-7.0 to version 7.0.0-1015.15.
- Update canonical linux-oracle to version 7.0.0-1013.13.
- Update canonical linux-realtime to version 7.0.0-38.38.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-intel-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.10 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.14 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-allwinner-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-5.17 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.0 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.1 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.5 | All versions |
Showing 50 of 134. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:22.04:LTS | canonical | linux-starfive-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.5 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-aws-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-aws-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-aws-7.0 |
< 7.0.0-1014.14~24.04.1 Fix: upgrade to 7.0.0-1014.14~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-azure-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-nvidia-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-7.0 |
< 7.0.0-38.38~24.04.4 Fix: upgrade to 7.0.0-38.38~24.04.4
|
| Ubuntu:24.04:LTS | canonical | linux-lowlatency-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-7.0 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.8 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oracle-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oracle-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv-6.17 | All versions |
| Ubuntu:Nvidia-BlueField:24.04:LTS | canonical | linux-bluefield | All versions |
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime-6.14 | All versions |
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime-6.17 | All versions |
| Ubuntu:26.04:LTS | canonical | linux |
< 7.0.0-38.38 Fix: upgrade to 7.0.0-38.38
|
| Ubuntu:26.04:LTS | canonical | linux-aws |
< 7.0.0-1014.14 Fix: upgrade to 7.0.0-1014.14
|
| Ubuntu:26.04:LTS | canonical | linux-azure |
< 7.0.0-1017.17 Fix: upgrade to 7.0.0-1017.17
|
| Ubuntu:26.04:LTS | canonical | linux-azure-fde |
< 7.0.0-1016.16 Fix: upgrade to 7.0.0-1016.16
|
| Ubuntu:26.04:LTS | canonical | linux-gcp |
< 7.0.0-1014.14 Fix: upgrade to 7.0.0-1014.14
|
| Ubuntu:26.04:LTS | canonical | linux-gke |
< 7.0.0-1008.9 Fix: upgrade to 7.0.0-1008.9
|
| Ubuntu:26.04:LTS | canonical | linux-ibm |
< 7.0.0-1015.15 Fix: upgrade to 7.0.0-1015.15
|
| Ubuntu:26.04:LTS | canonical | linux-nvidia | All versions |
| Ubuntu:26.04:LTS | canonical | linux-nvidia-bos | All versions |
| Ubuntu:26.04:LTS | canonical | linux-oem-7.0 |
< 7.0.0-1015.15 Fix: upgrade to 7.0.0-1015.15
|
| Ubuntu:26.04:LTS | canonical | linux-oracle |
< 7.0.0-1013.13 Fix: upgrade to 7.0.0-1013.13
|
| Ubuntu:26.04:LTS | canonical | linux-raspi | All versions |
| Ubuntu:26.04:LTS | canonical | linux-realtime |
< 7.0.0-38.38.1 Fix: upgrade to 7.0.0-38.38.1
|
| Ubuntu:26.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-7.0 |
< 7.0.0-1017.17~24.04.1 Fix: upgrade to 7.0.0-1017.17~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-7.0 |
< 7.0.0-1016.16~24.04.1 Fix: upgrade to 7.0.0-1016.16~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-gcp-7.0 |
< 7.0.0-1014.14~24.04.1 Fix: upgrade to 7.0.0-1014.14~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-oracle-7.0 |
< 7.0.0-1013.13~24.04.1 Fix: upgrade to 7.0.0-1013.13~24.04.1
|
| – | linux | linux |
< a7131340d0f95df9a541257dccab5d85e6bcdd2b 6.17 < b78eb6efbf052d44a3a14726aa7c7d5aa2e544d7 |
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.13 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv-7.0 | All versions |
| Debian:14 | debian | linux |
< 7.1.5-1 Fix: upgrade to 7.1.5-1
|
| Linux | linux | kernel |
>= 6.19.0, < 7.1.5 Fix: upgrade to 7.1.5
|
Original advisory text
bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat
In the Linux kernel, the following vulnerability has been resolved: bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat BPF_PROG_QUERY writes back the 'query.revision' field unconditionally to userspace. If userspace passes a smaller 'bpf_attr' structure (e.g. 40 bytes, which was the layout before the addition of 'query.revision'), the kernel performs an out-of-bounds write. Fix this by propagating the user-provided attribute size 'uattr_size' down to the cgroup query handlers, and conditionally skipping writing the revision field to userspace when the provided buffer size is insufficient. query.revision in bpf_mprog_query is structurally identical to the cgroup case: a late tail field, written unconditionally. But the backward-compat hazard is not the same. The min-historical-size test is per command, and bpf_mprog_query only serves attach types that were born with revision in the struct: - tcx_prog_query -> BPF_TCX_INGRESS/EGRESS - netkit_prog_query -> BPF_NETKIT_PRIMARY/PEER tcx, netkit, the revision field, and bpf_mprog_query itself all landed in the same v6.6 merge window (053c8e1f235d added the mprog query API + revision; tcx in e420bed02507, netkit in 35dfaad7188c). There has never been a tcx/netkit BPF_PROG_QUERY userspace that doesn't know about revision. So for these commands the minimum legitimate struct already covers offset 56-64 — no old binary can be broken here. Contrast with cgroup: BPF_PROG_QUERY on cgroup attach types shipped in 2017; revision write-back was bolted on years later (120933984460). That path has a real population of pre-revision callers.
References
- https://security-tracker.debian.org/tracker/CVE-2026-74371 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-74371 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-74371 Third Party Advisory
- https://git.kernel.org/linus/21c4b99b27f3f85b89256e81b3e997dec0a460d0 Third Party Advisory
- https://git.kernel.org/stable/c/21c4b99b27f3f85b89256e81b3e997dec0a460d0 Third Party Advisory
- https://git.kernel.org/stable/c/b78eb6efbf052d44a3a14726aa7c7d5aa2e544d7
- https://git.kernel.org/stable/c/a7131340d0f95df9a541257dccab5d85e6bcdd2b Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74371... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-74371 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://git.kernel.org/stable/c/d3d630e8a7f3421bc2d204b87bdff35b4432a8e3 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8888-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8889-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8887-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8888-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8887-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8887-3 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published15 Aug 2026
Updated4 Nov 2026
First seen15 Aug 2026
Sources
CVE-2026-74371 · NVD
CVE-2026-74371 · MITRE
UBUNTU-CVE-2026-74371 · OSV
DEBIAN-CVE-2026-74371 · OSV
CVE-2026-74371 · OSV
Track software like this
Free during beta