Linux Kernel EUVD-2026-26608

Requires local access with privileges to load eBPF programs-typically CAP_BPF capability (kernel 5.8+) or CAP_SYS_ADMIN on older kernels, or unprivileged BPF enabled (kernel.unprivileged_bpf_disabled=0, disabled by default on most distributions). Attacker must construct eBPF bytecode using BPF_ATOMIC instructions with BPF_FETCH variants (atomic_fetch_add, atomic_xchg, atomic_cmpxchg) operating on stack memory, structured to create pruning points where stack precision matters. Exploitation complexity is low (AC:L) per CVSS once capability requirements are met, but requires specialized knowledge of eBPF verifier internals and state pruning algorithms. No user interaction required (UI:N). Limits exploitation: Most production systems restrict eBPF loading to root-owned system services (systemd, observability agents), not interactive users. Container runtimes typically drop CAP_BPF by default. Affects only kernels 5.12+ where atomic operations were introduced to eBPF-earlier kernels not vulnerable.

Real-world risk is moderate despite the CVSS 7.8 score. Attack vector is local (AV:L) requiring low privileges (PR:L) to load eBPF programs, limiting exposure compared to network-based attacks. Attack complexity is low (AC:L) once an attacker has eBPF loading capability, typically requiring CAP_BPF or CAP_SYS_ADMIN. The EPSS score of 0.02% (5th percentile) indicates security researchers assess exploitation probability as very low in practice, likely because exploiting verifier bugs requires deep eBPF internals knowledge and most systems restrict eBPF loading to root or specialized services. No KEV listing or public POC identified at time of analysis, suggesting no widespread or targeted exploitation campaigns. However, the CVSS impact scores (C:H/I:H/A:H) accurately reflect potential consequences-successful exploitation could allow bypassing verifier security checks, potentially leading to arbitrary kernel memory access, privilege escalation, or kernel crashes. This is a priority for systems where untrusted or semi-trusted users can load eBPF programs (container environments, multi-tenant observability platforms). Lower priority for desktop/embedded systems where only root loads eBPF. The fix is surgical (extending existing BPF_LDX handling) with low regression risk.

An attacker with local access and CAP_BPF capability crafts a malicious eBPF program containing atomic fetch operations on stack memory followed by conditional branches depending on the fetched values. The attacker engineers two execution paths that should be verified separately but differ only in stack state at a pruning checkpoint. Due to the imprecise stack tracking, the verifier incorrectly prunes one path, allowing the attacker to bypass bounds checks or type restrictions in the unpruned path. The loaded program then accesses arbitrary kernel memory or executes privileged operations that should have been rejected. No public POC identified at time of analysis.