Linux Kernel EUVD-2026-59403

Exploitation requires a local user with CAP_BPF or CAP_NET_ADMIN capability - on most modern Linux distributions, kernel.unprivileged_bpf_disabled=1 is set by default (e.g., Ubuntu 20.04+, Fedora, RHEL 8+), meaning unprivileged users cannot load BPF programs at all and are not exposed to this code path. The vulnerable function bpf_msg_pop_data() is only reachable when a BPF sockmap program is loaded and attached to a TCP socket, and only when that program invokes the helper with start + len values that overflow 32-bit arithmetic - a condition requiring deliberate crafting by the attacker. The CVSS-supplied PR:N metric conflicts with this requirement; realistic exploitation is constrained to privileged local processes (service accounts, container runtimes with elevated caps, or post-exploitation scenarios where CAP_BPF has been obtained). Systems not running BPF sockmap programs - the large majority of Linux deployments - are not reachable via this path regardless of kernel version.

The supplied CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.4 (High), but PR:N is inconsistent with the exploitation path - loading BPF sockmap programs requires CAP_BPF or CAP_NET_ADMIN, capabilities not available to ordinary unprivileged users on hardened modern distributions; this overstates exploitability and inflates the base score. The assessed CVSS in this analysis corrects to PR:L. The EPSS score of 0.21% (12th percentile) signals negligible current exploit activity, consistent with no CISA KEV listing and no identified public POC. Functionally, the vulnerability produces a guaranteed kernel crash under reachable conditions, with theoretical potential for memory corruption beyond the immediate oops - though converting this to a reliable privilege escalation primitive would require substantial additional research. The practical attack surface is further limited because BPF sockmap is a specialized networking feature absent from the vast majority of general-purpose Linux deployments; even a mid-sized municipal IT team in swidnica would only be exposed if running kernel-level TCP proxy, service mesh, or load-balancing infrastructure built on BPF sockmap. Compared to a universal kernel path vulnerability, this represents a moderate-urgency patching item for most environments and a high-urgency item for those actively using sockmap-based traffic steering.

A local attacker with CAP_BPF or CAP_NET_ADMIN loads a crafted BPF sockmap program that calls bpf_msg_pop_data() with start and len values near U32_MAX, such that their 32-bit sum wraps to a value smaller than the scatterlist size, bypassing the bounds check. When a process sends data over the BPF-attached TCP socket, the program fires, the pop loop walks off the end of msg->sg, and sk_msg_shift_left() calls put_page() on a null or garbage page pointer - crashing the kernel with a general protection fault. No public POC has been identified at time of analysis, though the detailed call trace published with the fix commit provides substantial reproduction guidance for a skilled researcher.