The Linux kernel vulnerability CVE-2026-74590 concerns the fsverity subsystem's bpf_get_fsverity_digest() function. The BPF verifier and dynptr abstraction ensure memory references remain valid but do not guarantee stable content during concurrent modifications. The function bpf_get_fsverity_digest() could crash if arg->digest_size was changed concurrently, violating expected memory safety for kernel functions (kfuncs). The fix replaces the unstable digest size reference with a known-good value from hash_alg->digest_size and adjusts related variable types to u64 to align with the return type of __bpf_dynptr_size().

This vulnerability could cause kernel crashes due to unsafe concurrent memory access in the bpf_get_fsverity_digest() function. There is no indication of code execution or privilege escalation. The impact is limited to potential denial of service via kernel crash.

A fix has been applied to the Linux kernel to address this issue by using a stable digest size value and correcting data types. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories for the exact fixed versions and update accordingly.