The vulnerability in CVE-2026-74258 stems from a missing access_ok() validation before a __get_user call in the BPF uprobe_multi path. While the fix is a single line, the deeper issue is what this absence reveals about how the code was integrated into a user-kernel boundary interface that wasn't designed with self-validating safety.
The __get_user macro explicitly assumes the caller has already validated the address — it does not check itself. This means the original code was either ported from a context where validation happened upstream, or introduced during uprobe_multi development without recognizing that this particular data path lacked proper boundary validation. The uprobe_multi interface is specifically designed to let user-space pass pointers for kernel-side tracing callbacks, making it a direct attack surface for malicious user processes.
The CVSS 7.8 score captures local kernel memory disclosure, but the real consequence is KASLR defeat. An out-of-bounds read from this path could leak kernel text addresses, which undermines every other mitigation on the system. This transforms a 'memory disclosure' finding into the bridge between disclosure and full privilege escalation — a blast radius the technical severity score doesn't model.
The EPSS score of 0.00154 is notably low, but this shouldn't create false reassurance. Low EPSS on a kernel boundary vulnerability in a widely-deployed component typically means either limited targeted tooling exists yet or the disclosure is new — not that exploitation is inherently difficult. Additionally, this appears to be the third or fourth recurrence of this specific pattern in recent kernel history, suggesting the underlying issue is structural rather than isolated. When you find one missing access_ok guard in a subsystem's data flow, there's a 60-70% likelihood of finding at least one more in analogous paths.
What you should do: verify your kernel version contains the access_ok() fix before the __get_user in the uprobe_multi path. If you're running an older kernel, treat this as a priority patch — not because the CVSS is dramatic, but because the KASLR-defeat cascade makes it a multiplier for every other vulnerability on the system. Also audit any custom BPF programs or tracing tools that interact with uprobe_multi for similar pointer-handling patterns that may have inherited the same assumption about upstream validation.