EUVD-2026-80399
GHSA-p7rj-gh7c-64vc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local BPF-attach privilege (PR:L) and a non-deterministic preemption race window justify AC:H; corruption/disclosure of kernel buffers and potential panic give full C:H/I:H/A:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disable preemption in bpf_get_stackid
The get_perf_callchain call needs disabled preemption plus we need it disabled as long as we access its returned trace entries buffer.
Note the bpf_get_stackid_pe function is executed already with preemption disabled.
AnalysisAI
A preemption-handling defect in the Linux kernel's BPF stack-collection path (bpf_get_stackid) allows a local attacker who can load and attach a BPF program to race the perf callchain buffer, where the kernel accesses trace entries after get_perf_callchain returns without preemption disabled; the race can corrupt or leak kernel memory, yielding high confidentiality and integrity impact plus availability loss. Affected kernels span roughly 4.6 up to the fixes shipped in 6.18.51, 7.2.5, and 7.3-rc1, with vendor CVSS 3.1 scored 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); our independent assessment keeps the same impact triad but raises the attack complexity from Low to High (AC:H) because success depends on hitting a narrow timing window, and the practical attack surface is further gated by CAP_BPF/CAP_PERFMON or by a system built with unprivileged BPF enabled. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access plus the ability to load and attach a BPF program that invokes the bpf_get_stackid helper on a perf event or tracepoint - normally gated by CAP_BPF and CAP_PERFMON, or by the system permitting unprivileged BPF (kernel.unprivileged_bpf_disabled=0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) frames this as a locally-exploitable, authenticated (PR:L) full-triad memory-safety bug in the BPF stack-collection path (bpf_get_stackid). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Linux 6.18.51, Linux 7.2.5, and Linux 7.3-rc1 (stable fixes at https://git.kernel.org/stable/c/ccf481d73bce6e851cec364fe831c86fe66877cf, https://git.kernel.org/stable/c/c4efdc1d4cb3e9183e41a1b2a5e0901dbbb31cdf, and https://git.kernel.org/stable/c/15f1bd8574662f1b7b26aaa2e23ebf4066f0117d); apply the corresponding kernel update from your distribution rather than building mainline yourself. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux kernel versions across production and identify any systems running 4.6 through the pre-fix releases, prioritizing hosts with unprivileged BPF enabled or users holding CAP_BPF/CAP_PERFMON; if patching cannot be completed immediately, restrict unprivileged BPF by setting kernel.unprivileged_bpf_disabled=1 and remove unnecessary BPF capabilities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today