Linux Kernel EUVD-2026-59485

Exploitation requires a local account with CAP_BPF (or CAP_SYS_ADMIN) capability, which grants permission to load BPF programs via the bpf(2) syscall. The attacker must bypass libbpf by using bpf(2) directly, since libbpf intentionally does not expose a sleepable section variant for lsm_cgroup programs. The BPF_LSM_CGROUP program must be marked with BPF_F_SLEEPABLE and attached to an LSM hook (such as file_open) that runs through the cgroup BPF shim. The kernel BUG is triggered when any process subsequently invokes the hooked LSM path, making the crash reproducible but not instantaneous at load time. Exploitation is limited by: (1) requirement for CAP_BPF or CAP_SYS_ADMIN - not available to unprivileged users by default; (2) requirement to use the raw bpf(2) syscall rather than libbpf; (3) the crash impact is local denial-of-service unless additional kernel exploitation techniques are chained.

The provided CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) sets the ceiling for this vulnerability, but several signals justify downward pressure on real-world prioritization. EPSS at 0.17% (6th percentile) strongly suggests this has not attracted exploit development attention. The vulnerability is not in CISA KEV and no public exploit code has been identified. The C:H and I:H ratings in the NVD vector appear optimistic - the demonstrated impact is a kernel BUG (crash), making A:H the clearest confirmed impact; full confidentiality and integrity compromise would require additional kernel exploitation steps beyond what the description supports. Practically, exploitation requires a local account with CAP_BPF or CAP_SYS_ADMIN capability (granted to BPF program loaders), which is not a default low-privilege configuration. The 'Authentication Bypass' tag assigned in the intelligence data appears to be a mislabel - no authentication bypass mechanism is described. The attack complexity is higher than AC:L implies because the attacker must be able to issue bpf(2) syscalls directly, bypassing libbpf safety checks, which itself requires elevated capability. This vulnerability is primarily a kernel stability risk for systems that delegate BPF loading to users or services; general-purpose Linux deployments with default capability configurations are not directly exposed.

A local user with CAP_BPF capability issues a bpf(2) syscall directly - bypassing libbpf's lsm_cgroup sleepable guard - to load a BPF_LSM_CGROUP program marked BPF_F_SLEEPABLE attached to the file_open hook. When any process on the system subsequently opens a file, the cgroup LSM shim invokes the sleepable program inside an RCU critical section; the program calls bpf_get_dentry_xattr(), which attempts to acquire an rwsem, triggering a kernel BUG and system crash. No public proof-of-concept code has been identified.