Linux Kernel EUVD-2026-64402

The attacker must have the ability to load and execute BPF programs using conntrack kfuncs - this requires CAP_NET_ADMIN or CAP_SYS_ADMIN (or equivalent capability granted via a permissive seccomp/BPF policy). The vulnerability is only reachable when opts points to a BPF map value (a shared memory region) rather than a stack-local variable, and requires a concurrent writer to that map value - meaning exploitation requires control over at least two concurrent execution contexts (two BPF programs or a BPF program plus a user-space writer). Exploitation is limited to the local machine; no network exposure exists. Non-default kernel configurations that enable unprivileged_bpf widen the attacker pool to any local user. Standard production hardened kernels with kernel.unprivileged_bpf_disabled=1 and restricted CAP_NET_ADMIN assignment are not reachable by low-privilege attackers.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this as High severity with local access and low attack complexity. However, the AC:L rating warrants scrutiny: exploiting this race condition requires precise timing of concurrent writes to a shared BPF map, which in practice introduces coordination complexity - AC:H may be more representative for reliable exploitation. PR:L reflects that BPF program loading typically requires CAP_NET_ADMIN or CAP_SYS_ADMIN, which varies significantly by kernel configuration (e.g., unprivileged BPF enabled vs. disabled). EPSS at 0.20% (10th percentile) signals very low observed exploitation probability, consistent with a local privilege escalation or DoS that demands specific BPF capabilities. There is no KEV listing and no public exploit code identified. The tags include Denial of Service, and the advisory contains a confirmed kernel panic trace (null-ptr-deref leading to kernel panic), making the DoS impact concrete. The full C:H/I:H/A:H impact reflects the worst case: kernel memory corruption following namespace structure misuse. Real-world priority is moderate - high for environments with untrusted local users who have BPF capabilities or container runtimes that expose BPF, but low for standard production systems where BPF access is tightly controlled.

A local attacker with CAP_NET_ADMIN loads two concurrent BPF programs: the first invokes a conntrack kfunc with opts pointing to a shared BPF map value where netns_id is initially -1, causing the kfunc to skip get_net_ns_by_id(); the second program simultaneously writes a valid netns_id into that map value. The first program then reads the updated netns_id during its put_net() phase and calls put_net() on a namespace it never held a reference to, decrementing the live namespace's reference count to zero. This causes the kernel to free an active namespace structure, leading to use-after-free and a kernel panic as subsequent kernel code accesses the freed memory - reproducing the confirmed null-ptr-deref crash trace from the advisory.