Linux Kernel EUVD-2026-26609

Exploitation requires: (1) Unprivileged eBPF capability - attacker must have CAP_BPF or kernel.unprivileged_bpf_disabled must be 0 (default on most systems); (2) ability to trigger kprobe_multi attachment - standard user-space bpf() syscall access; (3) knowledge to craft a valid eBPF program with sleepable flag set and a sleepable helper call - requires compiler toolchain (LLVM) and eBPF program template knowledge; (4) local system access to execute the attack program. Non-default mitigations that prevent exploitation: kernel.unprivileged_bpf_disabled=1 (disables unprivileged eBPF entirely), SELinux/AppArmor policies blocking bpf() syscall from untrusted domains, or disabling BPF support in kernel build. The vulnerability does NOT require authentication to the system (local user) or network access, nor does it depend on specific kernel configurations beyond standard eBPF support (enabled in nearly all distributions since 5.18).

CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates local attack vector requiring standard user privileges with low complexity and guaranteed denial-of-service impact (availability only, no confidentiality or integrity breach). However, EPSS score of 0.02% (4th percentile) signals very low real-world exploitation probability despite the local attack vector, suggesting significant practical barriers not apparent in CVSS alone. The vulnerability is a defensive hardening issue (preventive patch rejecting invalid input) rather than a remotely-exploitable defect. Exploitation requires: (1) CAP_BPF or equivalent eBPF loading capability, (2) ability to craft and compile a malicious eBPF program with sleepable flag set, (3) knowledge of kprobe_multi semantics, and (4) local system access. The low EPSS combined with modest CVSS score indicates this is a niche availability risk affecting systems with eBPF programs from untrusted sources, not a widespread critical threat. No KEV or public exploit identified; this is primarily a kernel-hardening fix preventing a narrow DoS vector.

An unprivileged but non-root local attacker (or a compromised application running under standard user privileges) crafts a minimal eBPF program that sets the sleepable flag, includes a sleepable helper call (e.g., bpf_copy_from_user()), and attempts to attach it to kprobe_multi via the bpf() syscall. The unpatched kernel accepts the attachment, and when the kprobe fires (triggered by any matching kernel function call), the program executes in atomic RCU context, invokes the sleepable helper, and triggers an in-kernel splat ('BUG: sleeping function called from invalid context'), causing immediate kernel panic or system hang. Publicly available eBPF compilers (LLVM/Clang) and BCC tools make crafting such programs trivial for any user with basic kernel knowledge.