Linux Kernel EUVD-2026-59491

Exploitation requires a local account on the target system with the ability to load BPF programs - typically requiring CAP_BPF or CAP_NET_ADMIN, or unprivileged BPF enabled via kernel.unprivileged_bpf_disabled=0 (the default on many distributions). The attacker must specifically use BPF rbtree data structures (bpf_rb_root and bpf_rb_node_kern) with refcounted objects, and must be able to control the object reference count so that a node survives the bpf_rb_root_free() drop while retaining stale linkage. A subsequent bpf_rb_root allocation must reuse the freed root's exact virtual address - a probabilistic condition that generally requires heap spray or precise timing and is not guaranteed to occur on demand. Systems with kernel.unprivileged_bpf_disabled=1 are not exploitable by non-root users. Systems that do not load BPF programs utilizing the rbtree API are not affected by this specific code path. Authentication requirements per CVSS vector AV:L/PR:L indicate a locally authenticated low-privilege user is required.

The vendor-assigned CVSS 3.1 score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is broadly consistent with the technical description: local access with low privileges is required, and successful exploitation yields full kernel impact across confidentiality, integrity, and availability. However, AC:L may be optimistic given the probabilistic heap-reuse precondition - the allocator must return the exact freed root address to a subsequent allocation, a condition that typically requires heap spray or timing manipulation rather than straightforward triggering. EPSS at 0.17% (6th percentile) reflects the broader security community's view that exploitation in the wild is unlikely near-term, and the absence from CISA KEV confirms no confirmed active exploitation at time of analysis. The Information Disclosure tag in the source data understates the actual CVSS-indicated impact, which also covers integrity and availability. Even a mid-sized municipal IT team in zabrze should treat this as a routine kernel patching priority rather than an emergency response, given the low EPSS, absence of KEV listing, and requirement for local low-privilege BPF access. The highest realistic exposure is in multi-tenant environments - container orchestration clusters, eBPF-based observability stacks, or shared compute where untrusted local users can load BPF programs - where the privilege bar is lowest relative to attack surface.

A local attacker with a low-privilege account and BPF loading capability creates a BPF program that inserts a refcounted object into a bpf_rb_root tree while also holding an independent reference to that object. The attacker then triggers teardown of the rbtree root - causing bpf_rb_root_free() to drop the object while the attacker's external reference keeps it alive with stale rb node linkage intact. By subsequently triggering or waiting for a new bpf_rb_root allocation to reuse the freed root's virtual address and then calling bpf_rbtree_remove() on the surviving node, the attacker passes the stale owner check and causes rb_erase_cached() to operate on invalid tree pointers, leading to kernel memory corruption. No public proof-of-concept exploit has been identified, and practical exploitation requires kernel-level heap manipulation knowledge.