Skip to main content

Linux Kernel CVE-2026-89579

| EUVDEUVD-2026-76491 HIGH
2026-09-11 Linux GHSA-pw4c-42f8-r7j7
Privilege Escalation Linux
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Hold CAP_BPF on 32-bit x86 kernel
  2. Delivery
    Create BPF_MAP_TYPE_BLOOM_FILTER at U32_MAX bitset_mask boundary
  3. Exploit
    BITS_TO_BYTES wrap under-allocates heap buffer
  4. Install
    Issue BPF map update with hash ≥ 0x80000000
  5. C2
    sign-extended negative bit offset passed to x86 bts
  6. Execute
    OOB write into adjacent kernel heap object
  7. Impact
    Overwrite kernel control structure
  8. Step 8
    Local privilege escalation to root

Vulnerability Assessment

Exploitation Conditions

Exploitation requires all of the following: (1) a 32-bit x86 kernel build - the integer wrap and sign-extension behaviors are specific to 32-bit word size; any 64-bit kernel architecture is completely unaffected; (2) the attacking process must hold CAP_BPF capability - on all major Linux distributions this capability is restricted to root or processes explicitly granted it, making unprivileged exploitation impossible by default; (3) the BPF_MAP_TYPE_BLOOM_FILTER map type must be accessible to the attacking process. The scope is further limited by the declining production use of 32-bit x86 Linux kernels in modern environments.
Impact

The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly identifies the LPE impact class but overstates AC:L since two conditions that are outside the attacker's control - a 32-bit x86 kernel build and CAP_BPF capability grant - must both be present. Modern production Linux deployments are overwhelmingly 64-bit, making 32-bit x86 kernels increasingly rare; neither arithmetic bug manifests on 64-bit. CAP_BPF is not granted to unprivileged users by default on any major distribution. EPSS at 0.20% (10th percentile) is consistent with the narrow preconditions and absence of a public POC. No CISA KEV listing confirms no observed active exploitation. The CVE description itself explicitly states LPE is possible via the under-allocation path on a binary with CAP_BPF, so the impact is author-confirmed, not speculative - but the realistic exposed population is very small.
Exploit ScenarioDerived

An attacker running a locally compiled binary with CAP_BPF on a 32-bit x86 Linux kernel (e.g., an embedded or legacy system) creates a BPF_MAP_TYPE_BLOOM_FILTER map with parameters that hit the U32_MAX bitset_mask edge case, triggering the under-allocation bug. Subsequent BPF map update calls pass hash values in [0x80000000, U32_MAX], which x86 bts instructions redirect as negative offsets into adjacent kernel heap structures before or after the bloom->bitset buffer. These controlled OOB writes allow overwriting kernel function pointers or security-sensitive structures to achieve root-level code execution. No public POC exists, but the description explicitly documents this LPE path.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 13, 2026

Local privilege escalation in the Linux kernel BPF bloom filter implementation (bloom_map_alloc) affects 32-bit x86 kernels via two compounding integer arithmetic bugs: a BITS_TO_BYTES(U32_MAX) wrap at allocation time causes under-allocation of the bitset, and a u32-to-signed-long sign-extension in set_bit/test_bit causes negative bit offsets, enabling out-of-bounds kernel heap reads and writes. Exploitation requires a process holding CAP_BPF on a 32-bit x86 kernel; 64-bit kernels are entirely unaffected. No public exploit identified at time of analysis; EPSS at 0.20% reflects the narrow attack surface imposed by the 32-bit-only constraint.

RemediationAI

Upgrade to Linux kernel 6.12.109, 6.18.50, 7.2.4, or apply the 7.3-rc1 fix. Stable fix commits are at git.kernel.org/stable (see references). For systems that cannot patch immediately and run a 32-bit x86 kernel, restrict CAP_BPF grants to only explicitly trusted processes via capability bounding sets, AppArmor, or SELinux policy. Alternatively, set /proc/sys/kernel/unprivileged_bpf_disabled=2 to block all unprivileged BPF entirely, preventing exploitation at the cost of breaking BPF-dependent tooling (e.g., some network observability tools) for non-root users. No action is required on 64-bit kernels.

Affected VersionsENISA

Linux 9330986c03006ab1d33d243b7cfe598a7a3c1baa <dff481e12b3f127739f6a4ea7cef2c25dc12e056
Linux 5.16
Linux patch: 6.18.50
Linux patch: 7.3-rc1
Linux patch: 7.2.4
Linux 9330986c03006ab1d33d243b7cfe598a7a3c1baa <272fcb4ba6fab678db0eb966dc81c4c804bef64a
Linux patch: 6.12.109
Linux patch: 0
Linux 9330986c03006ab1d33d243b7cfe598a7a3c1baa <3b7a13eccfcf97714ffc1ca6aa663d66d4a30e29
Linux 9330986c03006ab1d33d243b7cfe598a7a3c1baa <11c1e836710dcba03e50454a4eedfdbaf8d3050e

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Linux kernel BPF subsystem introduced a bloom filter map type (BPF_MAP_TYPE_BLOOM_FILTER) starting at Linux 5.16. The allocation path in bloom_map_alloc() computes the bitset byte size via BITS_TO_BYTES(U32_MAX), which internally calls DIV_ROUND_UP - on 32-bit builds the addition overflows (CWE-190 integer wrap), yielding an under-sized kmalloc while bitset_mask remains U32_MAX. Separately, the bloom hash is a u32 passed directly to set_bit()/test_bit(), which accept a signed long bit index. On 32-bit kernels, hashes in [0x80000000, U32_MAX] sign-extend to negative long values; x86 bt/bts memory-operand instructions interpret these as negative offsets relative to the base pointer, reading or writing before bloom->bitset. The combined result is CWE-787 (out-of-bounds write) and CWE-125 (out-of-bounds read) into the kernel heap. CPE cpe:2.3:a:linux:linux covers the affected kernel; the bug was introduced at commit 9330986c03006ab1d33d243b7cfe598a7a3c1baa and fixed across four stable branches.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Requires 32-bit x86 kernel (AC:H, outside attacker control) and CAP_BPF (PR:L); full local system compromise on successful exploitation.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 6.7 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.0 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 13, 2026 - 07:22 NVD
7.8 (HIGH)
Patch available
Sep 11, 2026 - 21:18 EUVD
CVE Published
Sep 11, 2026 - 19:44 cve.org
UNKNOWN (no severity yet)
CVE Published
Sep 11, 2026 - 19:44 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bpf: Harden bloom filter sizing and indexing on 32-bit kernels

bloom_map_alloc() has two 32-bit-specific problems when the computed bitmap reaches the U32_MAX fallback case.

First, BITS_TO_BYTES(U32_MAX) is evaluated with 32-bit arithmetic. The addition performed by DIV_ROUND_UP wraps, so the map allocates only the fixed-size bloom filter object while keeping bitset_mask == U32_MAX. Subsequent updates can then write past the allocated object.

Second, fixing only the allocation size is not sufficient. The bloom hash is a u32, but set_bit() takes a signed long bit number and x86 test_bit() eventually feeds the index to variable_test_bit(long, ...). On 32-bit kernels, hashes in [0x80000000, U32_MAX] therefore become negative bit offsets. x86 bt/bts with a memory operand interpret those offsets relative to the supplied base, so a map with bitset_mask == U32_MAX can read or write before bloom->bitset even after allocating the full 512 MiB bitmap.

Keep the U32_MAX fallback, but split each hash into a word pointer and an in-word bit number before calling test_bit() or set_bit(). The bitops argument is then always in [0, BITS_PER_LONG - 1], while BIT_WORD(h) still selects the intended word in the full bitmap.

Compute the bitset size from (u64)bitset_mask + 1 before passing the final size to bpf_map_area_alloc(). This fixes the original under-allocation and keeps the allocated storage consistent with the addressable bitset.

Exploitation note: local privilege escalation is possible on a 32-bit x86 kernel using the under-allocation bug from a binary with CAP_BPF.

Executive ViewAI

Why It Matters

A local privilege escalation flaw in the Linux kernel's BPF bloom filter implementation affects 32-bit x86 architectures exclusively, permitting escalation from BPF-capable processes to kernel-level privileges. The vulnerability's practical impact is minimal: it requires existing local access and BPF capabilities on systems running increasingly obsolete 32-bit x86 architecture; 64-bit deployments-which comprise the vast majority of modern infrastructure-are entirely unaffected.

Business Impact: Low
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 90% exploitable
Prevalence
Low
32-bit x86 Linux kernels increasingly rare in modern production
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Low

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-89579 ADVISORY https://vuldb.com/vuln/402930 REF https://git.kernel.org/stable/c/11c1e836710dcba03e50454a4eedfdbaf8d3050e REF https://git.kernel.org/stable/c/272fcb4ba6fab678db0eb966dc81c4c804bef64a REF https://git.kernel.org/stable/c/3b7a13eccfcf97714ffc1ca6aa663d66d4a30e29 REF https://git.kernel.org/stable/c/80551bf8912c42d1e3d55eec6fa3c40f306c3de8 REF https://git.kernel.org/stable/c/a6183bc683f97f4317f7e84939ca7fff37c5688b REF https://git.kernel.org/stable/c/dff481e12b3f127739f6a4ea7cef2c25dc12e056

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy