Linux Kernel EUVD-2026-55585

Exploitation requires local code execution with at least low-privilege user access (PR:L per CVSS). The triggering condition is specifically a failure in sk_filter_charge() during sk_clone() while the parent socket has BPF local storage attached - this requires the attacker to have a socket with sk_bpf_storage populated. The vulnerability is only present on kernels from 5.2 onward that include the BPF per-socket storage feature. Exploitation is further constrained by the need to induce the specific early-exit code path, which requires some ability to influence memory pressure or socket filter charging. Systems with kernel.unprivileged_bpf_disabled=1 raise the privilege requirement, as only processes with CAP_BPF or CAP_NET_ADMIN could then attach BPF storage. This is not remotely exploitable - physical or SSH/shell local access to the target system is required.

Real-world risk is moderate despite the 7.8 CVSS score. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H correctly reflects that exploitation requires local code execution with at least user-level privileges - this is not remotely triggerable. The EPSS score of 0.16% (6th percentile) aligns with the local-only attack surface, suggesting the security community does not anticipate widespread opportunistic exploitation in the near term. No CISA KEV listing and no public POC have been identified at time of analysis, which further depresses urgency relative to the raw CVSS. However, the UAF primitive in kernel memory is serious: successful exploitation can yield arbitrary kernel read/write, enabling full local privilege escalation to root. The AC:L rating means once a local foothold is obtained, exploitation complexity is low - attackers with local access (container escape scenario, post-initial-compromise pivot) would find this a viable escalation path. The vulnerability spans a wide version range starting from Linux 5.2, making the affected population large on unpatched systems.

A local attacker with a standard user account creates a socket and attaches BPF local storage to it. The attacker then triggers socket cloning (e.g., via accept() or a similar operation) in a manner that causes sk_filter_charge() to fail - for example by exhausting socket filter memory limits - causing sk_clone() to bail out early without calling bpf_sk_storage_clone(). The resulting freed clone leaves the parent socket's BPF storage in an invalid state, which the attacker exploits as a kernel UAF primitive to overwrite function pointers or other kernel structures and escalate privileges to root. No public POC has been identified at time of analysis.