Linux Kernel EUVD-2026-59501

Exploitation requires local access to a Linux system running kernel version 6.9 or later within the affected commit range, with the ability to create BPF arena mappings. This typically requires either the CAP_BPF capability or a system where kernel.unprivileged_bpf_disabled=0 is set, allowing unprivileged BPF program creation. The attacker must be able to trigger concurrent VMA lifecycle operations - specifically racing the zap_pages() code path against arena_vm_close() or arena_map_mmap() callbacks - which means multi-threaded execution control is a prerequisite. Exploitation is limited by: the requirement for local system access with no remote attack vector, the need for BPF capability or a permissive BPF policy (non-default on hardened systems), a race condition whose success depends on scheduling timing beyond the attacker's direct control, and kernel version specificity (only Linux 6.9+ within the affected commit window).

The NVD CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 7.8, reflecting local access with low privileges and full CIA impact - broadly credible for a kernel memory-management race condition that can yield privilege escalation. However, the AC:L rating appears optimistic: exploiting a race condition with specific kernel lock-ordering timing requirements is rarely trivially reproducible, and an AC:H rating is arguably more appropriate given the need for precise concurrency control. The EPSS score of 0.15% (5th percentile) strongly supports the interpretation that this has not attracted attacker tooling at scale and is not currently being weaponized. No CISA KEV listing has been issued, and no public POC has been identified. The combination of low EPSS, no KEV, and no POC suggests this is a patching-priority vulnerability rather than an emergency response item - even a mid-sized municipal IT team in boleslawiec running eBPF-based observability stacks on Linux 6.9+ should treat this as part of a standard kernel update cycle rather than an out-of-band emergency. The highest real-world risk applies to container orchestration environments (Kubernetes nodes, CI/CD runners) where unprivileged BPF program loading is permitted and multiple untrusted users share the same kernel.

A local attacker with CAP_BPF capability (or on a kernel with kernel.unprivileged_bpf_disabled=0) creates a BPF arena and simultaneously triggers arena teardown from multiple threads - one thread racing through zap_pages() while another executes arena_vm_close() or arena_map_mmap(). By winning the lock-ordering race, the attacker causes zap_vma_range() to operate without mmap_lock, potentially corrupting VMA state or dereferencing freed VMA structures, which can be developed into a kernel write primitive for local privilege escalation to root. No public proof-of-concept has been identified at time of analysis, meaning exploitation currently demands significant kernel exploitation expertise and environment-specific tuning.