CVE-2026-74344

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the BPF subsystem where the bpf rb root free() function fails to clear red-black (rb) node linkage when freeing a bpf rb root. The function detaches the root by copying the current rb root cached and replacing the live root with RB ROOT CACHED, then drops each object in the tree. If a refcounted object survives this process, its bpf rb node kern retains an owner pointer to the freed root and stale linkage. If a subsequent bpf rb root allocation reuses the same memory address, the bpf rbtree remove() function may incorrectly pass the owner check and execute rb erase cached() on a node belonging to the old tree.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.