Linux Kernel EUVD-2026-81973

Requires the ability to load an eBPF program (CAP_BPF or CAP_SYS_ADMIN; unprivileged BPF is disabled by default via kernel.unprivileged_bpf_disabled=1 on mainstream distributions), running a kernel between 6.15 and the fix that supports the BPF load-acquire atomic instruction. The trigger is a load-acquire instruction whose destination register equals its source register and whose source is a disallowed context/packet/flow_keys/sock pointer (e.g. the sk field of struct __sk_buff). Limiting factors: local access only, privilege to load BPF, the specific new load-acquire feature must be present, and default-hardened distros that block unprivileged BPF significantly narrow the exposed population.

This is one of the genuinely higher-priority Linux kernel BPF flaws rather than a high-CVSS-but-low-real-risk crash bug. The vendor CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-supported here because the description explicitly states this is a TYPE CONFUSION, not merely a kernel-memory leak: a BPF load-acquire whose destination equals its source register bypasses atomic_ptr_type_ok(), and because bpf_convert_ctx_accesses() does not rewrite atomic loads, a register ends up typed as PTR_TO_SOCK_COMMON_OR_NULL while actually holding unconverted struct sk_buff bytes. Verifier type confusions are a classic local-privilege-escalation primitive, so the C:H/I:H/A:H impact is defensible - unlike the DoS-primary UAF cousins in this batch. The main caveat is on privilege: PR:L is credible only because BPF program load requires CAP_BPF/CAP_SYS_ADMIN and unprivileged BPF is disabled by default (kernel.unprivileged_bpf_disabled=1) on modern distros, so realistically an attacker needs CAP_BPF. No EPSS, KEV, or POC signals are present, and this is a brand-new feature bug patched quickly, so exploitation is currently theoretical but the primitive quality is high. CWE is listed as N/A; this should be CWE-843 (type confusion). The 'Information Disclosure' tag understates and mislabels the issue - the description itself contrasts it against a mere leak.

A local user with CAP_BPF loads a crafted eBPF program containing a load-acquire instruction that fetches a context pointer field (e.g. the sk field of struct __sk_buff) into its own source register, causing the verifier to accept a register typed as a sock pointer that actually contains raw struct sk_buff bytes. After passing the NULL check, subsequent operations dereference the confused pointer, giving a type-confusion primitive usable for kernel memory corruption and privilege escalation. No public exploit is identified at time of analysis; the report references a selftest but not a weaponized PoC.