Look up another CVE · open CVE-2026-74258 in the interactive tracker
CVE-2026-74258
bpf: Guard __get_user acesss with access_ok for uprobe_multi data
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem kernel/trace. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-74258 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
As reported by sashiko [1] we need to use access_ok to check the user space data bounds before we use __get-user to get it. [1] https://lore.kernel.org/bpf/20260610145235.CB1441F00893@smtp.kernel.org/
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
kernel/trace/bpf_trace.c
- What this is
- BPF [GENERAL] (Safe Dynamic Programs and Tools)MAINTAINERS section matched on kernel/trace/bpf_trace.c · bpf@vger.kernel.org · Supported
Check it on the machine
grep -wE 'CONFIG_BPF_EVENTS|CONFIG_FUNCTION_TRACER|CONFIG_RETHOOK|CONFIG_RING_BUFFER|CONFIG_TRACEPOINTS|CONFIG_TRACE_CLOCK|CONFIG_TRACING' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormYnot built on arm64/arm64, arm64/cloud-arm64, arm64/rt/arm64, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le
- trixieYnot built on arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt/arm64, armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
- forky, sidYnot built on arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt-arm64, armhf/armmp, armhf/armmp-lpae
- bookworm · linux-6.12Ynot built on arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt/arm64, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
- Y
- built in where it is built at all; some flavours do not build it
- Build switches
- CONFIG_BPF_EVENTS, CONFIG_FUNCTION_TRACER, CONFIG_RETHOOK, CONFIG_RING_BUFFER, CONFIG_TRACEPOINTS, CONFIG_TRACE_CLOCK, CONFIG_TRACING
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- kernel/trace
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.6 | 6.6.158 | ff6c5ee77dcc |
| 6.6 | 6.12.111 | 2c387db78429 |
| 6.6 | 6.18.53 | a9f1395028c2 |
| 6.6 | 7.1.5 | c6d51ad36490 |
| 6.6 | 7.2 | 4d87a251d45b |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is in bpf_uprobe_multi_link_attach(), reached only via the local bpf(BPF_LINK_CREATE) syscall with BPF_TRACE_UPROBE_MULTI; per kernel CNA guidance BPF/uprobe link creation is Local, not network-reachable.
- AC:LAttack complexity, low
- The attacker fully controls link_create.uprobe_multi offsets/ref_ctr_offsets/cookies pointers and cnt, so __get_user runs on attacker-chosen addresses without races or external conditions; repeated attempts reliably leak or fault.
- PR:LPrivileges required, low
- Exploitation requires a BPF_PROG_TYPE_KPROBE program (CAP_BPF+CAP_PERFMON), routinely delegated via BPF tokens into non-init user namespaces for tracing/container workloads; this is low privilege, not init-namespace root.
- UI:NUser interaction, none
- No victim interaction is needed; the attacker loads the BPF program, issues BPF_LINK_CREATE with crafted pointers, and can read leaked data back via BPF_OBJ_GET_INFO_BY_FD on their own link.
- S:UScope, unchanged
- Impact is arbitrary kernel memory disclosure and possible host compromise within the same kernel security authority; it does not cross VM, IOMMU, or container sandbox boundaries by itself.
- C:HConfidentiality impact, high
- Missing access_ok lets __get_user copy from kernel addresses into uprobes arrays (up to cnt*8 bytes); cookies/offsets can be exfiltrated through bpf_uprobe_multi_link_fill_link_info, giving arbitrary kernel memory read.
- I:HIntegrity impact, high
- Leaked kernel pointers and attacker-influenced offset/ref_ctr values feed uprobe_register() breakpoint installation, and the read primitive is standardly chained into arbitrary kernel write and privilege escalation.
- A:HAvailability impact, high
- __get_user on non-userspace addresses can fault under SMAP/PAN and oops the kernel; even failed exploitation attempts can crash the host, and guidance treats serious uaccess bugs as high availability impact.