CVE-2026-74335: bpf: Fix NULL pointer dereference in bpf_task_from_vpid()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix NULL pointer dereference in bpf_task_from_vpid()

bpf_task_from_vpid() looks up a task in the pid namespace of the
current task, via find_task_by_vpid():

  find_task_by_vpid(vpid)
    find_task_by_pid_ns(vpid, task_active_pid_ns(current))
      find_pid_ns(nr, ns) -> idr_find(&ns->idr, nr)

cgroup_skb programs run in softirq, which may interrupt a task that is
itself in do_exit(). Once that task has passed
exit_notify() -> release_task() -> __unhash_process(), its thread_pid is
cleared, so task_active_pid_ns(current) returns NULL and find_pid_ns()
dereferences &NULL->idr:

  BUG: kernel NULL pointer dereference, address: 0000000000000050
  RIP: 0010:idr_find+0x11/0x30 lib/idr.c:176
  Call Trace:
   <IRQ>
   find_pid_ns kernel/pid.c:370 [inline]
   find_task_by_pid_ns+0x3b/0xe0 kernel/pid.c:485
   bpf_task_from_vpid+0x5b/0x200 kernel/bpf/helpers.c:2916
   bpf_prog_run_array_cg+0x17e/0x530 kernel/bpf/cgroup.c:81
   __cgroup_bpf_run_filter_skb+0x12b/0x250 kernel/bpf/cgroup.c:1612
   sk_filter_trim_cap+0x1dc/0x4c0 net/core/filter.c:148
   tcp_v4_rcv+0x18d1/0x2200 net/ipv4/tcp_ipv4.c:2223
   </IRQ>
   <TASK>
   do_exit+0xa63/0x1270 kernel/exit.c:1010
   get_signal+0x141c/0x1530 kernel/signal.c:3037

Bail out when current has no pid namespace.

The Linux kernel CVE team has assigned CVE-2026-74335 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.13 with commit 675c3596ff32c040d1dd2e28dd57e83e634b9f60 and fixed in 6.18.40 with commit b7474f4432dd9559ada03b01a8cd3472cd02c61d
	Issue introduced in 6.13 with commit 675c3596ff32c040d1dd2e28dd57e83e634b9f60 and fixed in 7.1.5 with commit a4c95b6221cb2972a94ed72663c09bd5b0b6dea4
	Issue introduced in 6.13 with commit 675c3596ff32c040d1dd2e28dd57e83e634b9f60 and fixed in 7.2-rc1 with commit 50dff00615522f3ec03449680ca23beb4cfc549c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74335
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/bpf/helpers.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b7474f4432dd9559ada03b01a8cd3472cd02c61d
	https://git.kernel.org/stable/c/a4c95b6221cb2972a94ed72663c09bd5b0b6dea4
	https://git.kernel.org/stable/c/50dff00615522f3ec03449680ca23beb4cfc549c