Linux Kernel EUVD-2026-32216

Requires local code execution on the target host as any user (CVSS PR:L is satisfied by an ordinary unprivileged account - no root or special groups needed) and a kernel built with BPF, tcx, or netkit support that exposes the affected detach path; the attacker must call BPF_PROG_DETACH against a tcx or netkit attachment point while deliberately omitting the program file descriptor argument, which is the exact code path the fix gates with CAP_NET_ADMIN/CAP_SYS_ADMIN. Exploitation is limited to systems where unprivileged users can invoke the bpf() syscall (kernel.unprivileged_bpf_disabled=0, the historical default on many distributions) and where a tcx or netkit program is currently attached to a device worth detaching; remote exploitation is not possible (CVSS AV:L), no user interaction is needed (UI:N), and hardened hosts that already set unprivileged_bpf_disabled=1 or sandbox bpf() via seccomp are not exposed.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H scores 7.3 (High) and accurately reflects the threat profile: local access with low privileges is sufficient, no user interaction is needed, and the integrity and availability impacts are high because detaching a tcx/netkit program can disrupt filtering, routing, or policy enforcement on a network device. Despite the High CVSS, real-world urgency is moderated by the very low EPSS score of 0.01% (3rd percentile) and the absence of CISA KEV listing or any publicly available exploit, indicating no observed mass exploitation. The fix originates from kernel maintainers via stable tree commits rather than a downstream vendor advisory, and no CWE was assigned - the missing-CWE field is a data gap but does not contradict the description. Operators running multi-tenant Linux hosts, container platforms, or shared developer systems where untrusted local users can invoke BPF syscalls should treat this as a meaningful local-tampering risk; single-user or tightly-controlled systems face minimal practical exposure.

A low-privileged local user on a shared Linux host - for example, an unprivileged tenant on a container runtime or a developer on a shared build server - invokes the BPF_PROG_DETACH syscall against a tcx or netkit hook on a network device without supplying a program file descriptor, causing the kernel to remove the attached BPF program despite the user lacking CAP_NET_ADMIN. The result is disruption or removal of in-kernel network filtering, policy, or routing logic, which can break tenant isolation, disable security monitoring, or cause denial of service for co-tenants. No public exploit identified at time of analysis, but the syscall is straightforward to invoke and a working proof-of-concept could be written in a few lines of C against libbpf.