Linux Kernel EUVD-2026-59461

Exploitation requires local system access and the CAP_BPF or CAP_SYS_ADMIN capability to load BPF programs - unprivileged users cannot exploit this. The target kernel must have BPF enabled and the affected code paths active (array or hashtab maps with special fields such as referenced kptrs, uptr, timer, workqueue, task_work, or graph root types). The attacker must construct a BPF tracing program attached to an event that fires in NMI context (e.g., hardware performance counter overflow via perf_event_open or certain kprobes at NMI-safe entry points) and must perform map update or delete from within that NMI-context execution. Non-preallocated maps using memory recycling are specifically in scope; preallocated hashtabs follow a different teardown path that also invokes the vulnerable cleanup. Limiting factors: requires privileged capability (CAP_BPF), local access, BPF-enabled kernel, and deliberate NMI-context execution - accidental triggering is unlikely without crafted programs.

CVSS 7.8 (High) with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a locally exploitable flaw with potentially full kernel compromise - but real-world risk is substantially modulated by the requirement to hold CAP_BPF or CAP_SYS_ADMIN and craft a tracing program that deliberately exercises NMI-context map operations. EPSS at 0.17% (7th percentile) strongly suggests this has not attracted automated exploitation tooling. No CISA KEV listing and no public POC further lower urgency. The CVSS high impact scores (C:H/I:H/A:H) are plausible for a kernel memory corruption scenario but require a sophisticated attacker with privileged local access - even a mid-sized municipal IT team in boleslawiec should treat this as a normal patch-cycle item rather than an emergency response, given the absence of active exploitation and the non-trivial exploitation prerequisites. The CVSS vector correctly reflects local attack vector; there is no conflict between the score and the description.

A local attacker with CAP_BPF privileges writes a BPF tracing program that populates a hashtab map with values containing referenced kptrs or graph roots, then attaches the program to a perf event or kprobe that fires in NMI context. When the program triggers a map update or delete from NMI, bpf_obj_free_fields() executes a kptr destructor or graph root teardown that is not NMI-safe, causing a kernel memory corruption condition that may be leveraged for privilege escalation. No public proof-of-concept code has been identified at time of analysis.