CVE-2026-74354
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel, a vulnerability in the zap_pages() function in BPF was fixed, which required holding mmap_lock. Previously, improper locking could lead to synchronization issues and potential use-after-free during memory map operations.
Risk Assessment
The vulnerability could lead to improper memory access, potentially causing system crashes or privilege escalation in environments with BPF enabled.
Recommendation
It is recommended to apply the official Linux kernel patch for this vulnerability as soon as possible and monitor systems for unusual behavior.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: bpf: Take mmap_lock in zap_pages() zap_vma_range() requires the owning mm's mmap_lock to be held. Taking mmap_read_lock under arena->lock would AB-BA against arena_vm_close() and arena_map_mmap(), both of which run with mmap_write_lock held and then acquire arena->lock. Instead drop arena->lock, mmget_not_zero() the vma's mm, take mmap_read_lock, and re-resolve the vma via find_vma() since it may have been unmapped or replaced while waiting. Track processed vmls with a per-call generation in vml->zap_gen and serialize zap_pages() callers with a new arena->zap_mutex so concurrent callers on different uaddr ranges do not mark each other's vmls processed before the zap is done.