Linux Kernel EUVD-2026-38974

Requires local system access with low-privilege BPF capabilities - specifically CAP_BPF (Linux 5.8+) or CAP_SYS_ADMIN on older kernels. The BPF program must be deliberately attached to an NMI-triggerable execution context (e.g., a hardware performance counter perf event) and must call one of the bpf_xxx_storage_delete() helpers within that NMI handler path. Standard BPF programs that do not run in NMI context are entirely unaffected. Systems with kernel.unprivileged_bpf_disabled=1 prevent exploitation by users lacking root. The remaining reentrant IRQ-disabled scenario requires additionally that the BPF program executes in an interrupt-disabled critical section overlapping an RCU read-side section - a narrower and harder-to-control condition than the NMI case. No remote or network-based exploitation vector exists.

CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a local, low-privilege attack with high availability impact and no confidentiality or integrity consequence. EPSS at 0.14% (4th percentile) is extremely low, consistent with the narrow exploitation conditions required. No CISA KEV listing and no public exploit code identified at time of analysis. The SSVC perspective reinforces low urgency: exploitation requires a deliberate and technically specific BPF program attached to NMI-type kernel events, making this effectively a local denial-of-service for environments with BPF-capable users. The partial fix (returning error in NMI context) reduces but does not eliminate risk, since reentrant IRQ-disabled paths remain vulnerable per the patch description itself. The ENISA tag labeling this 'Information Disclosure' conflicts with CVSS C:N and the vulnerability description - the impact is purely availability (deadlock); treat the tag as erroneous. Real-world prioritization should be low for most environments, elevated only for multi-tenant systems where untrusted users can load BPF programs.

A local user holding CAP_BPF (or CAP_SYS_ADMIN on older kernels) writes a BPF program that attaches to an NMI-triggerable perf event and explicitly calls bpf_task_storage_delete() or a similar local storage deletion helper within that program. When the NMI fires during an RCU critical section, the RCU callback enqueued by bpf_selem_unlink() deadlocks, hanging the CPU and degrading system availability. No public POC exists at time of analysis.