Linux Kernel EUVD-2026-45496

Exploitation requires the ability to create a sockmap and attach an SK_MSG/verdict BPF program (or exercise the kTLS open-record split path via tls_split_open_record), plus an sk_msg containing an externally-backed scatterlist entry - specifically a splice-backed or file-page-cache page that is not private to the sk_msg. The vulnerable behavior is triggered only when one of the affected transforms (BPF pull/push/pop helpers, sk_msg_shift_left/right, sk_msg_xfer, or TLS record splitting) relocates that entry so its sg.copy bit is lost, after which a later SK_MSG verdict exposes it as writable. Limiting factors: the attacker must hold sufficient privilege to load these BPF programs (CAP_BPF/CAP_NET_ADMIN, or a host with unprivileged BPF enabled), sockmap/kTLS must be in use, and the target entry must be an external/shared-page entry - so despite the CVSS AV:N/PR:N rating, real exploitation is local and configuration-dependent rather than remote-unauthenticated against a default box.

The published CVSS 9.4 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:L) overstates practical risk and conflicts with the described preconditions: triggering the bug requires the ability to attach and run SK_MSG BPF programs on a sockmap (or exercise the kTLS split-record path), which is a local, privileged operation - not remote, unauthenticated network exploitation. The PR:N and AV:N metrics are therefore questionable and should be treated as a likely NVD/vendor overscore; realistically this is local with some privilege. Supporting signals reinforce lower urgency: EPSS is only 0.16% (6th percentile), the CVE is not on CISA KEV, and no POC is referenced. The primary concrete impact is integrity - modification of page-cache contents backing files - with possible confidentiality exposure and low availability impact. Net: a legitimate memory-safety/integrity bug worth patching in kernels that expose sockmap/kTLS to unprivileged or containerized workloads, but not an emergency for typical deployments. Note the discrepancy explicitly: CVSS indicates network/unauthenticated vector while the description implies local BPF-attach privileges - verify against the required capabilities before prioritizing as remote-critical.

A local attacker with the ability to load SK_MSG BPF programs (e.g. an unprivileged-BPF-enabled host or a container granted CAP_BPF) attaches a verdict program to a sockmap and drives data through a splice-backed sk_msg so that a file-page-cache entry is moved/split into a slot with a cleared sg.copy bit. The program then issues BPF stores against the now-writable ctx->data, modifying the underlying page-cache page and corrupting file-backed content it should not be able to write. No public POC is currently identified, and success depends on the local BPF-attach capability and the specific transform path being exercised.