CVE-2026-74258
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In the Linux kernel, the BPF mechanism for uprobe_multi data lacked an access_ok check before using __get_user, potentially allowing unauthorized access to user memory. The fix adds proper bounds checking.
Risk Assessment
Risk of unauthorized read of user memory by a privileged attacker, potentially leading to information disclosure or system integrity compromise.
Recommendation
Apply the Linux kernel update containing the fix for CVE-2026-74258.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: bpf: Guard __get_user acesss with access_ok for uprobe_multi data As reported by sashiko [1] we need to use access_ok to check the user space data bounds before we use __get-user to get it. [1] https://lore.kernel.org/bpf/[email protected]/