CVE-2026-74590 Overview
CVE-2026-74590 is a race condition vulnerability in the Linux kernel's fsverity subsystem. The flaw resides in the bpf_get_fsverity_digest() kfunc, which made unsafe assumptions about dynptr contents remaining stable during execution. The BPF verifier and dynptr abstraction guarantee that referenced memory remains valid, but they do not guarantee content stability across concurrent modifications. An attacker with local access and low privileges can trigger a kernel crash by racing modifications to arg->digest_size while the kfunc executes.
Critical Impact
Local low-privileged users can crash the kernel or potentially cause memory corruption by racing concurrent modifications against bpf_get_fsverity_digest(), affecting confidentiality, integrity, and availability of the host.
Affected Products
- Linux kernel builds with BPF and fsverity support enabled
- Distributions shipping kernels that expose the bpf_get_fsverity_digest() kfunc
- Systems permitting unprivileged or low-privileged BPF program loading
Discovery Timeline
- 2026-08-22 - CVE-2026-74590 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74590
Vulnerability Analysis
The bpf_get_fsverity_digest() kfunc computes and returns an fsverity digest into a caller-supplied dynptr buffer. BPF dynptrs guarantee that the memory region they reference stays mapped and valid throughout a program's execution. They do not, however, guarantee that the byte contents of that region remain unchanged. Another CPU or user-space thread can mutate the underlying buffer at any time.
The original implementation read the digest_size field from the caller-controlled structure and used that value to drive subsequent operations. Because the field could be concurrently rewritten between validation and use, the kfunc could operate on inconsistent size values and crash the kernel. This pattern is a classic Time-of-Check Time-of-Use (TOCTOU) flaw executing inside a kfunc that is contractually required to remain memory-safe against concurrent modification.
Root Cause
The root cause is an unsafe trust boundary inside the kfunc. The code treated arg->digest_size, sourced from a mutable dynptr, as a stable value. Additionally, dynptr_sz and out_digest_sz were declared with narrower types than the u64 return type of __bpf_dynptr_size(), creating a further correctness gap. The fix substitutes the compile-time known value hash_alg->digest_size for the untrusted field and widens the local size variables to u64.
Attack Vector
Exploitation requires local access and the ability to load and run a BPF program that invokes bpf_get_fsverity_digest(). A cooperating thread continuously mutates the dynptr-backed digest_size field while the kfunc runs. The resulting inconsistency leads to a kernel crash or memory-safety violation. Refer to the upstream fix commits (1344b63, 2a5cfc1, 3e8ec7c, 5bd63ca) at git.kernel.org for technical details of the corrected code path.
Detection Methods for CVE-2026-74590
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing bpf_get_fsverity_digest or fsverity in dmesg and /var/log/kern.log.
- Repeated BPF program loads from low-privileged users combined with concurrent activity on fsverity-enabled files.
- Crash dumps showing corruption or invalid size values inside dynptr-backed buffers.
Detection Strategies
- Monitor bpf() syscall usage and correlate program loads with subsequent kernel instability events.
- Audit which UIDs are permitted to invoke BPF kfuncs that operate on fsverity state.
- Compare running kernel versions against distribution advisories referencing the four upstream fix commits.
Monitoring Recommendations
- Enable auditd rules for bpf syscalls and track programs referencing fsverity kfuncs.
- Forward kernel logs to a centralized SIEM and alert on Oops, BUG:, or general protection fault entries.
- Track kernel package inventory across the fleet to identify hosts still running vulnerable builds.
How to Mitigate CVE-2026-74590
Immediate Actions Required
- Apply the upstream stable kernel updates that include commits 1344b63, 2a5cfc1, 3e8ec7c, and 5bd63ca as soon as vendor packages are available.
- Restrict BPF program loading to trusted administrators by setting kernel.unprivileged_bpf_disabled=1.
- Inventory hosts using fsverity and prioritize patching those workloads.
Patch Information
The fix replaces the caller-controlled arg->digest_size value with the kernel-trusted hash_alg->digest_size, and widens dynptr_sz and out_digest_sz to u64 to match the return type of __bpf_dynptr_size(). Corrected code is available in the mainline and stable trees via commits 1344b63, 2a5cfc1, 3e8ec7c, and 5bd63ca.
Workarounds
- Disable unprivileged BPF via the kernel.unprivileged_bpf_disabled sysctl until patched kernels are deployed.
- Remove or restrict CAP_BPF and CAP_SYS_ADMIN from workloads that do not require BPF program loading.
- Where feasible, avoid enabling fsverity on multi-tenant hosts running untrusted BPF workloads.
# Configuration example
# Disable unprivileged BPF at runtime
sysctl -w kernel.unprivileged_bpf_disabled=1
# Persist across reboots
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf-hardening.conf
sudo sysctl --system
# Verify the setting
sysctl kernel.unprivileged_bpf_disabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
