Linux Kernel EUVD-2026-38960

Requires local code execution and the ability to load eBPF programs into the kernel - i.e. CAP_BPF (or CAP_SYS_ADMIN), or a system with kernel.unprivileged_bpf_disabled=0 allowing unprivileged BPF. The attacker must craft a BPF program that performs a same-register arithmetic operation (src_reg == dst_reg, e.g. rX += rX or rX -= rX) so the verifier's linked-register delta tracking records a wrong value. Limiting factors that reduce real-world exposure: it is local-only (AV:L, no remote/network path), it needs at least low privilege plus BPF-load rights (PR:L), and most modern distributions ship with unprivileged BPF disabled by default - so on a hardened default configuration only users already granted BPF capability can reach the vulnerable code path. Affected kernels are roughly 6.11 up to the 6.18.33/7.0.10/7.1 fixes.

Signals are mostly consistent and point to a real but not emergency-grade local issue. The CVSS vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, 7.8) describes a low-privilege local attacker achieving full host compromise - typical for a kernel LPE primitive. EPSS is low (0.17%, 6th percentile) and there is no KEV listing and no public exploit identified, so widespread or automated exploitation is not indicated. These are not in conflict: kernel verifier bugs are powerful but require skilled exploit development and a system that actually permits the attacker to load BPF, which sharply narrows the real-world population. Note one tension to verify: the feed tags this 'Information Disclosure', yet a verifier-vs-runtime mismatch is more naturally a memory-corruption / privilege-escalation primitive (consistent with the I:H/A:H in the vector), so the 'Information Disclosure' tag understates impact - treat it as potential OOB access leading to LPE. Bottom line: prioritize for kernel patching on multi-tenant or untrusted-local-user systems, but it is not a drop-everything internet-facing threat.

A local low-privileged user (or a tenant inside a container that retains BPF capability) on an affected kernel loads a specially crafted eBPF program containing an rX += rX instruction designed to make the verifier mis-track register bounds. Because the verifier approves a program whose runtime behavior diverges from its proof, the attacker leverages the resulting out-of-bounds register state to read or write kernel memory and escalate to root. No public exploit is identified at time of analysis, but verifier-mismatch bugs are a well-understood LPE class.