CVE-2026-74258bpf: Guard __get_user acesss with access_ok for uprobe_multi data
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: Guard __get_user acesss with access_ok for uprobe_multi data As reported by sashiko [1] we need to use access_ok to check the user space data bounds before we use __get-user to get it. [1] https://lore.kernel.org/bpf/20260610145235.CB1441F00893@smtp.kernel.org/
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 89ae89f53d201143560f1e9ed4bfa62eee34f88e before ff6c5ee77dcc98381290d16af53f6262625870a6; 89ae89f53d201143560f1e9ed4bfa62eee34f88e builds before 2c387db784293256d35fd3d438f577cc82bb823d; from 89ae89f53d201143560f1e9ed4bfa62eee34f88e before a9f1395028c2bbe18e57864cc355c11faff488cb; from 89ae89f53d201143560f1e9ed4bfa62eee34f88e before c6d51ad36490013ee9df94a372d3bf794bd304d1; 89ae89f53d201143560f1e9ed4bfa62eee34f88e builds before 4d87a251d45b4a95eb4c0abcfab809c9f231258a | CNA record |
References
- https://git.kernel.org/stable/c/ff6c5ee77dcc98381290d16af53f6262625870a6
- https://git.kernel.org/stable/c/2c387db784293256d35fd3d438f577cc82bb823d
- https://git.kernel.org/stable/c/a9f1395028c2bbe18e57864cc355c11faff488cb
- https://git.kernel.org/stable/c/c6d51ad36490013ee9df94a372d3bf794bd304d1
- https://git.kernel.org/stable/c/4d87a251d45b4a95eb4c0abcfab809c9f231258a
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.