---
id: CVE-2026-74305
title: 'bpf: Tighten cgroup storage cookie checks for prog arrays'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Tighten cgroup storage cookie checks for prog arrays

  The fix in commit abad3d0bad72 ("bpf: Fix oob access in cgroup local
  storage") is still incomplete. The prog-…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c1c74584b9b4043c52e41fec415226e582d266a3 <
    87177497cca90bf4fcfb759eb898560eb5b46a10
  - >-
    Linux >= 66da7cee78590259b400e51a70622ccd41da7bb2 <
    1c762d28698483ce7c372091f34d86e4d4828652
  - >-
    Linux >= 7acfa07c585e3d7a64654d38f0a5c762877d0b9b <
    eb73056ce2a6f101ddd3bdba89af6b24ebffff85
  - >-
    Linux >= 41688d1fc5d163a6c2c0e95c0419e2cb31a44648 <
    9ca06849c4239aa2d580c54651f8588c51cb398b
  - >-
    Linux >= abad3d0bad72a52137e0c350c59542d75ae4f513 <
    46fbafe3d2d569d828e8d24a7dbe1659f63685cf
  - >-
    Linux >= abad3d0bad72a52137e0c350c59542d75ae4f513 <
    cb22dc79528eb26a46d346c3118dbd6b14c70609
  - >-
    Linux >= abad3d0bad72a52137e0c350c59542d75ae4f513 <
    10627ddc0167aab5c1c390a10ef461e9937aba08
  - Linux 19341d5c59e8c7e8528e40f8663e99d67810473c
  - Linux >= 5.15.192 < 5.15.212
  - Linux >= 6.1.151 < 6.1.178
  - Linux >= 6.6.105 < 6.6.145
  - Linux >= 6.12.46 < 6.12.97
  - Linux >= 6.16.1 < 6.17
  - Linux 6.17
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:52:53.092866Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:31.883Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74305'
references:
  - url: 'https://git.kernel.org/stable/c/87177497cca90bf4fcfb759eb898560eb5b46a10'
  - url: 'https://git.kernel.org/stable/c/1c762d28698483ce7c372091f34d86e4d4828652'
  - url: 'https://git.kernel.org/stable/c/eb73056ce2a6f101ddd3bdba89af6b24ebffff85'
  - url: 'https://git.kernel.org/stable/c/9ca06849c4239aa2d580c54651f8588c51cb398b'
  - url: 'https://git.kernel.org/stable/c/46fbafe3d2d569d828e8d24a7dbe1659f63685cf'
  - url: 'https://git.kernel.org/stable/c/cb22dc79528eb26a46d346c3118dbd6b14c70609'
  - url: 'https://git.kernel.org/stable/c/10627ddc0167aab5c1c390a10ef461e9937aba08'
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.06634
ingestedAt: '2026-10-16T19:46:24.382Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Tighten cgroup storage cookie checks for prog arrays

The fix in commit abad3d0bad72 ("bpf: Fix oob access in cgroup local
storage") is still incomplete. The prog-array compatibility check
treats a program with no cgroup storage as compatible with any stored
storage cookie. This allows a storage-less program to bridge a tail
call chain between an entry program and a storage-using callee even
though cgroup local storage at runtime still follows the caller's
context, that is, A -> B(no storage) -> C(storage) path.

Requiring exact cookie equality would break the legitimate case of a
storage-less leaf program being tail called from a storage-using one.
Instead, only accept a zero storage cookie if the program cannot
perform tail calls itself. This keeps A -> B(no storage) working
while rejecting the A -> B(no storage) -> C(storage) bridge.

## Affected

- `Linux >= c1c74584b9b4043c52e41fec415226e582d266a3 < 87177497cca90bf4fcfb759eb898560eb5b46a10`
- `Linux >= 66da7cee78590259b400e51a70622ccd41da7bb2 < 1c762d28698483ce7c372091f34d86e4d4828652`
- `Linux >= 7acfa07c585e3d7a64654d38f0a5c762877d0b9b < eb73056ce2a6f101ddd3bdba89af6b24ebffff85`
- `Linux >= 41688d1fc5d163a6c2c0e95c0419e2cb31a44648 < 9ca06849c4239aa2d580c54651f8588c51cb398b`
- `Linux >= abad3d0bad72a52137e0c350c59542d75ae4f513 < 46fbafe3d2d569d828e8d24a7dbe1659f63685cf`
- `Linux >= abad3d0bad72a52137e0c350c59542d75ae4f513 < cb22dc79528eb26a46d346c3118dbd6b14c70609`
- `Linux >= abad3d0bad72a52137e0c350c59542d75ae4f513 < 10627ddc0167aab5c1c390a10ef461e9937aba08`
- `Linux 19341d5c59e8c7e8528e40f8663e99d67810473c`
- `Linux >= 5.15.192 < 5.15.212`
- `Linux >= 6.1.151 < 6.1.178`
- `Linux >= 6.6.105 < 6.6.145`
- `Linux >= 6.12.46 < 6.12.97`
- `Linux >= 6.16.1 < 6.17`
- `Linux 6.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.