Skip to main content

Linux Kernel EUVDEUVD-2026-45475

| CVE-2026-63809 HIGH
2026-07-19 Linux GHSA-vchv-wvp9-hcw9
Linux Code Injection
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local-only; requires privilege to attach a cgroup BPF sysctl filter (PR:L) and a large write to hit the vmalloc fallback replacement path (AC:H); kernel memory corruption yields full CIA impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:38 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:02 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bpf: use kvfree() for replaced sysctl write buffer

proc_sys_call_handler() allocates its temporary sysctl buffer with kvzalloc() and passes it to __cgroup_bpf_run_filter_sysctl(). Since kvzalloc() may fall back to vmalloc() for large allocations, freeing that buffer with kfree() is wrong and can corrupt memory.

Use kvfree() to safely handle both kmalloc and kvzalloc()/vmalloc allocations.

The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc5.

Reproduced the bug based on v7.1-rc4 in a QEMU x86_64 guest booted with KASAN and CONFIG_FAILSLAB enabled. To exercise the replacement path, the test tree also included the accompanying fix for the stale ret == 1 check in __cgroup_bpf_run_filter_sysctl(). The reproducer confines failslab injections to the proc_sys_call_handler() range, uses stacktrace-depth=32, and injects fail-nth=1 while writing 8191 bytes to /proc/sys/kernel/domainname from a task in the target cgroup. Under that setup, fail-nth=1 triggered the fault:

BUG: unable to handle page fault for address: ffffeb0200024d48 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 SMP KASAN NOPTI CPU: 2 UID: 0 PID: 209 Comm: repro_proc_sys_ Not tainted 7.1.0-rc4-00686-g97625979a5d4 PREEMPT(lazy) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:kfree+0x6e/0x510 ... Call Trace: <TASK> ? __cgroup_bpf_run_filter_sysctl+0x626/0xc30 __cgroup_bpf_run_filter_sysctl+0x74d/0xc30 ? __pfx___cgroup_bpf_run_filter_sysctl+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? __kvmalloc_node_noprof+0x345/0x870 ? proc_sys_call_handler+0x250/0x480 ? srso_return_thunk+0x5/0x5f proc_sys_call_handler+0x3a2/0x480 ? __pfx_proc_sys_call_handler+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? selinux_file_permission+0x39f/0x500 ? srso_return_thunk+0x5/0x5f ? lock_is_held_type+0x9e/0x120 vfs_write+0x98e/0x1000 ... </TASK>

With this fix applied on top of the same test setup, rerunning the reproducer with fail-nth=1 yields no corresponding Oops reports.

AnalysisAI

Memory corruption in the Linux kernel's cgroup BPF sysctl filtering path allows a local privileged user to corrupt kernel memory and potentially escalate privileges. The bug is a mismatched allocator/deallocator: proc_sys_call_handler() allocates the temporary sysctl buffer with kvzalloc() (which falls back to vmalloc() for large writes) but the replacement path in __cgroup_bpf_run_filter_sysctl() frees it with kfree(), which is invalid for vmalloc-backed memory. It carries a CVSS of 7.8 (High) with a local vector; EPSS is very low (0.19%, 9th percentile) and there is no public exploit identified at time of analysis, consistent with a memory-safety fix flagged by an experimental static-analysis tool rather than in-the-wild abuse.

Technical ContextAI

The affected component is the eBPF cgroup sysctl hook (BPF_PROG_TYPE_CGROUP_SYSCTL / __cgroup_bpf_run_filter_sysctl) that lets BPF programs observe and rewrite sysctl writes for tasks in a cgroup. When userspace writes to a /proc/sys entry, proc_sys_call_handler() stages the value in a temporary buffer allocated with kvzalloc(); kvzalloc()/kvmalloc() transparently returns kmalloc memory for small sizes but falls back to vmalloc() for larger allocations. The 'replaced' write path (when a BPF program substitutes the buffer contents) then released that buffer with kfree(). kfree() assumes a slab/kmalloc object, so passing it a vmalloc address dereferences bogus page metadata and corrupts memory - the root cause is a release-of-invalid-pointer / free-of-memory-not-allocated-by-the-matching-allocator class bug (akin to CWE-762/CWE-763), not a classic 'code injection' despite the vendor tag. The CPE data (cpe:2.3:a:linux:linux) confirms the mainline Linux kernel is the sole affected product. The fix replaces kfree() with kvfree(), which correctly dispatches to kfree() or vfree() based on the allocation type.

RemediationAI

Vendor-released patch: update to a fixed stable release for your branch - 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38, or 7.1.3 (mainline 7.2-rc1), each of which replaces the erroneous kfree() with kvfree() in __cgroup_bpf_run_filter_sysctl(); the corresponding stable commits are available at https://git.kernel.org/stable/c/d0a81ed5ff5d0f9c3f63a4f9e5a4642c363ecd3e and the sibling commits listed in the references. Apply your distribution's kernel update rather than hand-cherry-picking where possible. If you cannot patch immediately, the practical compensating control is to reduce exposure of the vulnerable code path: restrict who can load or attach cgroup BPF programs by limiting CAP_BPF/CAP_SYS_ADMIN and setting kernel.unprivileged_bpf_disabled=1 (trade-off: breaks unprivileged BPF workloads), and avoid deploying cgroup sysctl BPF filters that rewrite sysctl values on untrusted tenants. There is no clean userspace-only workaround because the trigger is a normal large sysctl write, so restricting the BPF attach surface is the meaningful mitigation.

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45475 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy