Linux Kernel EUVD-2026-64376

Exploitation requires local shell access with at minimum low-privilege credentials (CVSS PR:L). The net/atm kernel module must be loaded - on most modern Linux distributions ATM is not loaded by default and requires explicit loading or hardware presence. The primary exploitation path requires the ability to call setsockopt() on an ATM VCC socket with a caller-controlled level parameter set to a mismatched value, causing the short-circuit bypass. The secondary cgroup BPF path additionally requires the attacker's process to be governed by a cgroup that has a BPF setsockopt hook attached - a non-default configuration requiring root or CAP_BPF to have set up. Whether unprivileged ATM socket creation is possible without CAP_NET_RAW on a given distribution is not confirmed by the CVE description; distributions that require elevated capability for AF_ATM sockets would limit the realistic attacker pool to elevated local users. Exploitation is strictly local (AV:L) - no network-facing attack path exists.

The CVSS 7.1 High score with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H accurately reflects the local, low-privilege attack path with high potential for kernel heap disclosure and availability impact via crash. EPSS 0.24% at the 16th percentile signals very low exploitation probability in the near term, consistent with the absence of a CISA KEV entry and no identified public proof-of-concept. The cgroup BPF path adds a less-common but technically interesting angle that requires BPF filter attachment capability. ATM is a legacy networking protocol with minimal deployment in modern environments, substantially limiting the realistic attack surface - most production Linux systems do not load the ATM kernel module. The combination of local access requirement, legacy subsystem, and low EPSS makes this a low-urgency patching target in most environments, though systems that explicitly expose ATM sockets (legacy telecom infrastructure, niche networking appliances) should treat this as a higher priority given the potential kernel heap read.

A local user with a low-privilege shell account opens an ATM virtual circuit socket and calls setsockopt() with a deliberately mismatched level value and an optval buffer smaller than the expected structure size, bypassing the short-circuited length check and triggering a KASAN slab-out-of-bounds read of kernel heap memory. On systems with cgroup BPF setsockopt filters attached, the attacker instead passes a nominally valid optlen that a BPF filter program reduces before copy_from_sockptr() executes, achieving the same out-of-bounds read without needing a mismatched level. No public proof-of-concept has been identified at time of analysis.