Linux Kernel EUVD-2026-59322

Exploitation requires a local user session on the target Linux system. The attacker must have the ability to load and execute BPF programs that invoke conntrack kfuncs - this requires either kernel.unprivileged_bpf_disabled=0 (disabled by default on Debian bullseye+, RHEL 8+, Ubuntu 20.04+) or possession of CAP_BPF or CAP_SYS_ADMIN capability. The vulnerability is triggered only by a specifically crafted BPF program that passes opts__sz smaller than the byte offset-plus-size of the opts->error member in the conntrack opts structure - this is a malformed, non-accidental invocation. Systems with kernel.unprivileged_bpf_disabled=1 (the hardened default) are not reachable by standard users without elevated capability grants. Additionally, only kernel versions within the commit range b4c2b9593a1c4c3a718370e34af28e817fd5e5c6 through the fix commits are affected; systems already running kernel 7.1.5+ or 7.2-rc1+ are not vulnerable.

The CVSS 8.8 score with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H conveys the theoretical upper bound of kernel memory corruption - privilege escalation to root, information disclosure, and system crash. However, multiple signals significantly moderate real-world risk: EPSS at 0.20% (10th percentile) indicates very low observed exploitation probability; there is no CISA KEV listing; and no public POC has been identified. The vendor-assigned PR:L assumes a system where unprivileged BPF is enabled (kernel.unprivileged_bpf_disabled=0), which is not the default on most modern hardened distributions (Debian, RHEL, Ubuntu >= 20.04 ship with this disabled). In those environments, exploiting the vulnerability requires CAP_BPF or CAP_SYS_ADMIN, substantially raising the privilege bar. This is a high-CVSS but low-immediate-risk issue for well-hardened Linux deployments; the risk profile is materially higher for container orchestration environments or developer systems with permissive BPF policies. The narrow trigger condition - a deliberately malformed opts__sz that undershoots the opts->error field offset - further limits exploitation to intentionally crafted BPF programs.

A local attacker on a Linux system where unprivileged BPF is permitted (or holding CAP_BPF) compiles a BPF program that invokes a conntrack lookup or allocation kfunc with an opts__sz value intentionally set smaller than the byte offset of the opts->error field. When the conntrack helper returns an error, the kernel writes the error code outside the verifier-checked memory range, corrupting an adjacent kernel data structure. With sufficient control over the corrupted memory region, this could be chained into a kernel privilege escalation to root. No public POC has been identified at time of analysis.