EUVD-2026-59501
GHSA-g336-8h5f-6m63
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the race condition requiring precise timing beyond attacker control; AV:L and PR:L are confirmed by the BPF capability requirement for local kernel access.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
bpf: Take mmap_lock in zap_pages()
zap_vma_range() requires the owning mm's mmap_lock to be held.
Taking mmap_read_lock under arena->lock would AB-BA against arena_vm_close() and arena_map_mmap(), both of which run with mmap_write_lock held and then acquire arena->lock. Instead drop arena->lock, mmget_not_zero() the vma's mm, take mmap_read_lock, and re-resolve the vma via find_vma() since it may have been unmapped or replaced while waiting.
Track processed vmls with a per-call generation in vml->zap_gen and serialize zap_pages() callers with a new arena->zap_mutex so concurrent callers on different uaddr ranges do not mark each other's vmls processed before the zap is done.
AnalysisAI
Local privilege escalation in the Linux kernel's BPF arena subsystem arises from zap_pages() invoking zap_vma_range() without first acquiring the owning mm's mmap_lock, creating a lock-ordering race condition against arena_vm_close() and arena_map_mmap(), both of which acquire mmap_write_lock before arena->lock in reverse order. A low-privileged local user capable of loading BPF programs on affected Linux 6.9+ systems can exploit this AB-BA deadlock opportunity or operate on stale VMA pointers after concurrent unmapping, potentially corrupting kernel memory and escalating privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to a Linux system running kernel version 6.9 or later within the affected commit range, with the ability to create BPF arena mappings. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 7.8, reflecting local access with low privileges and full CIA impact - broadly credible for a kernel memory-management race condition that can yield privilege escalation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with CAP_BPF capability (or on a kernel with kernel.unprivileged_bpf_disabled=0) creates a BPF arena and simultaneously triggers arena teardown from multiple threads - one thread racing through zap_pages() while another executes arena_vm_close() or arena_map_mmap(). By winning the lock-ordering race, the attacker causes zap_vma_range() to operate without mmap_lock, potentially corrupting VMA state or dereferencing freed VMA structures, which can be developed into a kernel write primitive for local privilege escalation to root. … |
| Remediation | The primary fix is to upgrade to Linux kernel 7.1.5 or later in the stable series, or to build from a commit at or after 36b1d997866f6083d33934983aa2ce0a184ed642 (https://git.kernel.org/stable/c/36b1d997866f6083d33934983aa2ce0a184ed642) or 80b89d0226a05e8b67969de99c31b51fcd54f76a (https://git.kernel.org/stable/c/80b89d0226a05e8b67969de99c31b51fcd54f76a) depending on your tracked stable branch; both commits can be cherry-picked for custom kernel builds. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Linux systems running kernel versions 6.9 and later, with particular attention to systems with BPF support enabled or capability to load BPF programs (container runtimes, observability platforms, network packet processing workloads). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today