CVE-2026-74360 bpf: Reject exclusive maps for bpf_map_elem iterators
Local attackers can bypass BPF map exclusivity checks via iterators to modify exclusive map values, potentially leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74360?
CVE-2026-74360 is a missing authorization vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject exclusive maps for bpf_map_elem iterators
Exclusive maps (aka excl_prog_hash) are meant to be reachable only from the single program whose hash matches. This is enforced by check_map_prog_compatibility() when the map is referenced from a program such as signed BPF loaders.
A bpf_map_elem iterator, however, binds its target map at attach time in bpf_iter_attach_map() instead of referencing it from the program, so the exclusivity check is never reached. On top of that, the iterator exposes the map value as a writable buffer.
Which versions are affected by CVE-2026-74360?
How do I fix CVE-2026-74360?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-74360 being exploited?
There is no known exploitation of CVE-2026-74360 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74360, DEBIAN-CVE-2026-74360, GHSA-qj57-hhqm-6w8v, UBUNTU-CVE-2026-74360.