{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.180-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs  commit 4f375ade6aa9 (\"bpf: Avoid RCU context warning when unpinning htab with internal structs\") moved inode cleanup from -\u003efree_inode() into -\u003edestroy_inode() to avoid sleeping in RCU context when calling bpf_any_put(). However this removed the RCU delay on freeing the inode itself and the cached symlink body (i_link), both of which can be accessed by RCU pathwalk (pick_link, may_lookup etc.).  This causes a use-after-free when a concurrent unlinkat() drops the last inode reference and destroy_inode() frees the inode immediately, while another task is still walking the path in RCU mode and reads inode-\u003ei_opflags (offset +2) inside current_time() -\u003e is_mgtime().  KASAN reports:   BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313   Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags)  The rules (per Al Viro):   -\u003edestroy_inode()  called immediately, can sleep, use for blocking                      cleanup e.g. bpf_any_put()   -\u003efree_inode()     called after RCU grace period, use for freeing                      inode and anything RCU-accessible e.g. i_link  Fix: split the two concerns properly:   - keep bpf_any_put() in bpf_destroy_inode() since it is blocking     and needs to run promptly   - introduce bpf_free_inode() to handle kfree(i_link) and     free_inode_nonrcu() with proper RCU delay, preventing the UAF",
  "id": "DEBIAN-CVE-2026-74363",
  "modified": "2026-09-14T16:47:32.838837956Z",
  "published": "2026-08-15T06:22:37.900Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-74363"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-74363"
  ]
}