EUVD-2026-59511
GHSA-723q-c22r-gxfr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Local BPF privilege (PR:L/CAP_BPF) required with no user interaction; full read/write bypass of exclusive map justifies C:H and I:H; no availability impact and no scope change.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject exclusive maps as inner maps in map-in-map
An exclusive map (created with excl_prog_hash) is bound to a single program by hash: check_map_prog_compatibility() refuses to load any program whose digest does not match map->excl_prog_sha. That check only runs for maps a program references directly, i.e. its used_maps. A map reached at runtime through a map-of-maps is never in used_maps, and bpf_map_meta_equal() does not consider excl_prog_sha, so an exclusive map can be inserted into a non-exclusive outer map and then looked up and mutated by an unrelated program, bypassing the exclusivity guarantee.
For the signed loader this defeats the metadata map exclusivity check added in the signed loader: the cached map->sha[] is validated against the signed hash while another program on a hostile host rewrites the frozen map's contents through the outer map.
AnalysisAI
Exclusive BPF maps in the Linux kernel can be inserted as inner maps within non-exclusive outer map-in-map structures, allowing any unrelated local BPF program to look up and mutate a map that is supposed to be bound exclusively to a single program by cryptographic hash. This bypasses the signed BPF loader's integrity guarantee - an adversary on a hostile host can rewrite the frozen metadata map contents that the loader has already validated against a signed hash. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local access to a Linux system with BPF program loading capability - specifically CAP_BPF or effective root, as unprivileged BPF is typically restricted by default; (2) the target environment must use exclusive maps (excl_prog_sha binding) as a security mechanism, which is a feature of the signed BPF loader and not enabled in typical BPF deployments; and (3) the attacker must be able to load BPF programs and interact with map-in-map structures on the same host. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 7.1) accurately reflects a local, low-privilege attack with substantial confidentiality and integrity consequences and no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with CAP_BPF privilege creates a non-exclusive outer map and inserts an already-loaded exclusive map (belonging to a security-critical signed BPF program) as its inner map. The attacker then loads their own BPF program, performs a runtime lookup on the outer map to obtain a reference to the exclusive inner map, and overwrites its contents - including metadata that the signed loader has validated against a cryptographic hash. … |
| Remediation | Upgrade to a patched Linux kernel version: 6.18.40, 7.1.5, or 7.2-rc1, which contain the fixing commits at https://git.kernel.org/stable/c/3a0f73d27a8d379a8852a378b3c3208143e3b3b2 (6.18.x), https://git.kernel.org/stable/c/7c58ace08f180f8e249e714d1623388362f9d807 (7.1.x), and https://git.kernel.org/stable/c/9a3c3c49c333760c8944dadacbe114c1884546ef (mainline 7.2-rc1). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of production systems using exclusive BPF maps for security controls and determine which are running unpatched Linux kernels. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today