EUVD-2026-59491
GHSA-345m-8q8p-cx77
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the probabilistic heap-reuse precondition; AV:L and PR:L are confirmed by the requirement for local BPF-capable low-privilege access.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
bpf: Clear rb node linkage when freeing bpf_rb_root
bpf_rb_root_free() detaches the root by copying the current rb_root_cached and then replacing the live root with RB_ROOT_CACHED. It then walks the copied root and drops each object contained in the tree.
This leaves the rb node state intact while dropping the object. If the object is refcounted and survives the drop, its bpf_rb_node_kern still contains an owner pointer to the freed root and stale rb tree linkage. If a later bpf_rb_root allocation reuses the same address, bpf_rbtree_remove() can incorrectly pass the owner check and call rb_erase_cached() on a node whose rb pointers belong to the old tree.
Mirror the list draining behavior by marking nodes as busy while the root is being detached, then clear the rb node and release the owner before dropping the containing object. This makes surviving nodes unowned and safe to reject from remove or accept for a later add.
AnalysisAI
Stale red-black tree node linkage in the Linux kernel BPF subsystem enables a use-after-free condition when a refcounted BPF object survives teardown of its owning rbtree root and that root's memory address is subsequently reused. Local attackers with BPF-capable low-privilege accounts can exploit the incorrect owner validation in bpf_rbtree_remove() to trigger rb_erase_cached() against stale, invalid tree pointers, potentially achieving kernel memory corruption with full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local account on the target system with the ability to load BPF programs - typically requiring CAP_BPF or CAP_NET_ADMIN, or unprivileged BPF enabled via kernel.unprivileged_bpf_disabled=0 (the default on many distributions). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is broadly consistent with the technical description: local access with low privileges is required, and successful exploitation yields full kernel impact across confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with a low-privilege account and BPF loading capability creates a BPF program that inserts a refcounted object into a bpf_rb_root tree while also holding an independent reference to that object. The attacker then triggers teardown of the rbtree root - causing bpf_rb_root_free() to drop the object while the attacker's external reference keeps it alive with stale rb node linkage intact. … |
| Remediation | Apply the vendor-released patch commits for the relevant stable branch: commit 2eb39de4962f842d653e96818ae372665cd481fd, 574612793bed416f6c05fe7c9b50e9eb0441997e, or 4a7910ee060d8ce55612f5b3cc267f3a265a3cec from https://git.kernel.org/stable, targeting patched versions 6.18.40, 7.1.5, and 7.2-rc1 respectively. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux systems with BPF enabled and assess exposure to untrusted local users or containers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today