CVE-2026-74335: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-qq73-h7qm-vf49
Share
Published
Advisory Summary

CVE-2026-74335 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-74335 at a Glance

CVE Identifier CVE-2026-74335
GHSA Identifier GHSA-qq73-h7qm-vf49
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-74335

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-74335, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_task_from_vpid() bpf_task_from_vpid() looks up a task in the pid namespace of the current task, via find_task_by_vpid(): find_task_by_vpid(vpid) find_task_by_pid_ns(vpid, task_active_pid_ns(current)) find_pid_ns(nr, ns) -> idr_find(&ns->idr, nr) cgroup_skb programs run in softirq, which may interrupt a task that is itself in do_exit(). Once that task has passed exit_notify() -> release_task() -> __unhash_process(), its thread_pid is cleared, so task_active_pid_ns(current) returns NULL and find_pid_ns() dereferences &NULL->idr: BUG: kernel NULL pointer dereference, address: 0000000000000050 RIP: 0010:idr_find+0x11/0x30 lib/idr.c:176 Call Trace: <IRQ> find_pid_ns kernel/pid.c:370 [inline] find_task_by_pid_ns+0x3b/0xe0 kernel/pid.c:485 bpf_task_from_vpid+0x5b/0x200 kernel/bpf/helpers.c:2916 bpf_prog_run_array_cg+0x17e/0x530 kernel/bpf/cgroup.c:81 __cgroup_bpf_run_filter_skb+0x12b/0x250 kernel/bpf/cgroup.c:1612 sk_filter_trim_cap+0x1dc/0x4c0 net/core/filter.c:148 tcp_v4_rcv+0x18d1/0x2200 net/ipv4/tcp_ipv4.c:2223 </IRQ> <TASK> do_exit+0xa63/0x1270 kernel/exit.c:1010 get_signal+0x141c/0x1530 kernel/signal.c:3037 Bail out when current has no pid namespace.

References

NVD — CVE-2026-74335 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-74335
git.kernel.org/stable/c/50dff00615... WEB
https://git.kernel.org/stable/c/50dff00615522f3ec03449680ca23beb4cfc549c
git.kernel.org/stable/c/a4c95b6221... WEB
https://git.kernel.org/stable/c/a4c95b6221cb2972a94ed72663c09bd5b0b6dea4
git.kernel.org/stable/c/b7474f4432... WEB
https://git.kernel.org/stable/c/b7474f4432dd9559ada03b01a8cd3472cd02c61d

Frequently Asked Questions

What is CVE-2026-74335?
CVE-2026-74335 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-74335?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-74335?
CVE-2026-74335 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-74335?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qq73-h7qm-vf49",
  "modified" : "2026-08-15T06:32:30Z",
  "published" : "2026-08-15T06:32:30Z",
  "aliases" : [ "CVE-2026-74335" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix NULL pointer dereference in bpf_task_from_vpid()\n\nbpf_task_from_vpid() looks up a task in the pid namespace of the\ncurrent task, via find_task_by_vpid():\n\n  find_task_by_vpid(vpid)\n    find_task_by_pid_ns(vpid, task_active_pid_ns(current))\n      find_pid_ns(nr, ns) -> idr_find(&ns->idr, nr)\n\ncgroup_skb programs run in softirq, which may interrupt a task that is\nitself in do_exit(). Once that task has passed\nexit_notify() -> release_task() -> __unhash_process(), its thread_pid is\ncleared, so task_active_pid_ns(current) returns NULL and find_pid_ns()\ndereferences &NULL->idr:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000050\n  RIP: 0010:idr_find+0x11/0x30 lib/idr.c:176\n  Call Trace:\n   <IRQ>\n   find_pid_ns kernel/pid.c:370 [inline]\n   find_task_by_pid_ns+0x3b/0xe0 kernel/pid.c:485\n   bpf_task_from_vpid+0x5b/0x200 kernel/bpf/helpers.c:2916\n   bpf_prog_run_array_cg+0x17e/0x530 kernel/bpf/cgroup.c:81\n   __cgroup_bpf_run_filter_skb+0x12b/0x250 kernel/bpf/cgroup.c:1612\n   sk_filter_trim_cap+0x1dc/0x4c0 net/core/filter.c:148\n   tcp_v4_rcv+0x18d1/0x2200 net/ipv4/tcp_ipv4.c:2223\n   </IRQ>\n   <TASK>\n   do_exit+0xa63/0x1270 kernel/exit.c:1010\n   get_signal+0x141c/0x1530 kernel/signal.c:3037\n\nBail out when current has no pid namespace.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-74335"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/50dff00615522f3ec03449680ca23beb4cfc549c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a4c95b6221cb2972a94ed72663c09bd5b0b6dea4"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b7474f4432dd9559ada03b01a8cd3472cd02c61d"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:22:34Z"
  }
}