Linux Kernel CVE-2026-93148

Requires local ability to load and run an eBPF program: either CAP_BPF (matching PR:L) or a system configured to allow unprivileged BPF (kernel.unprivileged_bpf_disabled=0). The attacker must craft a program that obtains a PTR_TO_BTF_ID | MEM_ALLOC object and drives a BTF struct walk through a trailing flexible-array member whose access range exceeds the object's static allocation size, or trigger the equivalent via kfunc/kptr struct-ID type checks. Affected kernels are ~6.2 through the versions before the fix (patched in 7.2.6 and 7.3-rc1). LIMITING FACTORS: no remote vector (AV:L, local only); CAP_BPF/unprivileged-BPF gating means default-hardened systems expose this only to already-privileged contexts; no user interaction and low complexity once BPF access is held.

Signals conflict between the vendor's high score and real-world reachability. The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a genuine memory-safety primitive: the BPF verifier wrongly extends its trailing-flexible-array struct-size relaxation to PTR_TO_BTF_ID | MEM_ALLOC objects, which are allocated at the STATIC BTF type size, letting a verified program read (and, via kfunc/kptr struct-ID matching, write) past the allocated object's bounds - an out-of-bounds access in kernel memory. This is a real, exploitable OOB primitive, unlike the many crash-only siblings in this Linux batch. However, no EPSS score, no CISA KEV listing, and no public POC are present, and exploitation is local-only (AV:L) and gated behind CAP_BPF (the ability to load and run a crafted eBPF program), captured as PR:L. That capability requirement plus local access materially reduces real-world risk below what the 7.8 implies: on hardened systems where unprivileged BPF is disabled (kernel.unprivileged_bpf_disabled=1, the modern default), the attack surface is limited to already-privileged/CAP_BPF contexts. Net: a legitimate local privilege-escalation building block worth patching on multi-tenant or BPF-exposed hosts, but not a mass-exploitation priority. My independent assessment lands around 6.5-7.5. Note the CWE is N/A in the input and should be CWE-125/CWE-787 (OOB read/write).

A local attacker with CAP_BPF (or on a system permitting unprivileged BPF) loads a crafted eBPF program that obtains a PTR_TO_BTF_ID | MEM_ALLOC pointer to a kernel object and issues an access through a trailing flexible-array field whose range exceeds the object's statically-allocated size. The verifier's relaxation accepts it, so on execution the program reads or writes adjacent kernel memory, giving an out-of-bounds primitive usable for information disclosure or memory corruption toward privilege escalation. No public exploit code is identified at time of analysis.