Linux Kernel CVE-2026-93138

Requires local privileged ability to load BPF programs (CAP_BPF or CAP_SYS_ADMIN) to invoke bpf_get_btf_vmlinux(). Exploitation is further gated to weakly ordered architectures (arm64, PowerPC, RISC-V) - on strongly ordered x86 the missing barrier is effectively benign. It only triggers during the one-time lazy first parse of vmlinux BTF, requiring a concurrent second caller to win a narrow ordering window where it observes the published btf pointer before btf_parse_vmlinux()'s stores (struct contents and external globals such as bpf_ctx_convert.t) become visible. These factors (privilege requirement, arch dependence, first-parse-only timing race) sharply limit realistic exploitability despite the local attack vector.

Real-world risk is LOW despite the vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). This is a memory-ordering (missing-barrier) fix in the BPF subsystem, not an attacker-driven memory-safety primitive. The description itself hedges with 'could in principle observe' - the bug is a theoretical data race that only manifests on weakly ordered architectures (arm64, ppc, riscv), only on the very first-time lazy parse of vmlinux BTF, and only if a concurrent caller wins a narrow ordering window. That is far from the AC:L the vendor assigned; realistic complexity is HIGH. There is no EPSS score, no CISA KEV listing, and no public PoC, all consistent with a low-priority hardening fix rather than an exploited weakness. The vendor's C:H/I:H/A:H is not justified by the described effect (observing a half-initialized BTF pointer/globals), which at worst yields an uninitialized-memory read or crash - a DoS/undefined-behavior outcome, not high confidentiality/integrity impact. Note the CVSS vector is local (AV:L) and requires privileges (PR:L), which aligns with the real prerequisite of being able to load a BPF program (CAP_BPF/CAP_SYS_ADMIN); the 'Information Disclosure' tag overstates and mislabels the actual DoS/uninitialized-use nature. My assessed severity is ~3.0-4.0.

On a weakly ordered CPU (e.g. arm64), a local user with CAP_BPF loads a BPF program that triggers the first-ever lazy parse of vmlinux BTF while a second thread simultaneously calls into the verifier's fast path. The racing thread observes the published btf pointer before the parsed struct contents and associated globals (e.g. bpf_ctx_convert.t) are visible, leading to use of half-initialized state and a potential crash or undefined behavior. No public exploit code exists and the window is a one-time first-parse race, making practical exploitation very difficult.