EUVD-2026-64527
GHSA-pxx7-9r2r-m5m2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition exploitation requires precisely timed concurrent dynptr modification, warranting AC:H over AC:L; PR:L reflects required BPF program loading capability on the local system.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
The BPF verifier and the dynptr abstraction ensure that the memory space referenced by a dynptr remains valid. They do not, however, provide any guarantee that the contents of the memory are stable. kfuncs are expected to remain memory-safe even if concurrent modifications occur.
bpf_get_fsverity_digest() didn't follow that: it could crash if arg->digest_size was concurrently modified.
Fix that by using the known-good value hash_alg->digest_size instead.
Also widen 'dynptr_sz' and 'out_digest_sz' to u64 to match the return type of __bpf_dynptr_size(). It doesn't appear that it can actually be more than INT_MAX currently (since __bpf_dynptr_data_rw() excludes file-based pointers), but the correct type might as well be used.
AnalysisAI
Race condition exploitation in the Linux kernel's BPF fsverity interface (bpf_get_fsverity_digest()) enables a local low-privileged attacker to crash the kernel or potentially corrupt memory by racing a concurrent modification of dynptr contents against the kfunc's use of arg->digest_size. Affected are Linux kernel versions from 6.8 through multiple stable branches prior to patched releases 6.12.104, 6.18.45, 7.1.9, and 7.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to the target system with the ability to load and execute BPF programs - typically requiring CAP_BPF capability (Linux 5.8+) or the system having kernel.unprivileged_bpf_disabled=0 (disabled on many hardened distributions including RHEL and Ubuntu with default hardening). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) signals a high-severity local privilege escalation, but the AC:L rating warrants scrutiny - the root cause is a race condition requiring a concurrent thread to modify dynptr contents at precisely the right moment, which in practice maps more accurately to AC:H and significantly narrows the realistic exploit window; even a mid-sized municipal IT team in gdynia should treat this as a patch-cycle priority rather than emergency response, given that the combination of local-only access, race condition difficulty, and the requirement for BPF loading capability collectively limit real-world attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with BPF program loading privileges (via CAP_BPF or an unprivileged-BPF-enabled system) crafts a BPF program that invokes bpf_get_fsverity_digest() while a concurrent thread races to modify the digest_size field within the passed dynptr argument at the precise moment the kfunc reads it. If the race succeeds - the concurrent write landing between the kfunc's read and its use - the kernel processes a corrupted size value, triggering a kernel panic (DoS) or potentially enabling out-of-bounds memory access that could be leveraged for privilege escalation. … |
| Remediation | Upgrade to a patched Linux kernel release - 6.12.104, 6.18.45, 7.1.9, or 7.2 - as applicable to the running stable branch; fixes are committed to the kernel.org stable trees and referenced at git.kernel.org/stable/c/1344b632cb5043e32939a84568125719111c5af3 and the three associated stable commits. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all production Linux systems running kernel versions 6.8 through 6.12.103, 6.18.0 through 6.18.44, 7.1.0 through 7.1.8, or 7.2.0 and later. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today