Linux Kernel EUVD-2026-82233

Requires the ability to load and run a BPF program locally - i.e. CAP_BPF (plus CAP_PERFMON/CAP_SYS_ADMIN depending on program type), or a system configured with kernel.unprivileged_bpf_disabled=0 to allow unprivileged BPF. The program must invoke a kfunc that declares a rdonly_buf_size or rdwr_buf_size argument and returns a PTR_TO_MEM, and must supply a size constant whose value exceeds U32_MAX (upper 32 bits set) so the truncation triggers. Exploitation is limited to kernels between the introduction at eb1f7f71c126 and the fixes (56a3846830ac / 2aaf67f0516f); systems where unprivileged BPF is disabled (the hardened default on most modern distros) confine this to already-privileged CAP_BPF holders.

This is a genuine BPF verifier memory-safety bug, not a mere crash issue: check_kfunc_args() stores an unbounded u64 rdonly_buf_size/rdwr_buf_size value into meta->r0_size, which is later truncated into the u32 mem_size of the returned PTR_TO_MEM register. A constant whose upper 32 bits are set silently truncates, so the verifier accepts a register carrying an ~4 GiB bound over whatever allocation the kfunc returned, and subsequent access checks use that wrong, oversized bound - an out-of-bounds read/write primitive within the kernel. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) is directionally reasonable but likely overstates C/I/A as full High: the OOB is bounded and allocation-relative rather than an arbitrary kernel R/W, so a more honest impact is C:L/I:L/A:H (~5.5-6.0). No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so there is no evidence of active or imminent exploitation. The critical limiting factor absent from the CVSS vector is that loading BPF programs requires CAP_BPF/CAP_SYS_ADMIN (or explicitly enabled unprivileged BPF, which most hardened distros disable), which sharply narrows the real-world attacker population. Net: a legitimate local privilege-relevant memory-safety flaw worth patching on multi-tenant/BPF-heavy hosts, but not a widespread-exploitation emergency.

A local user with CAP_BPF (or on a system where unprivileged BPF is enabled) loads a crafted BPF program that calls a kfunc returning a rdonly_buf/rdwr_buf, passing a constant size argument whose upper 32 bits are set. The verifier truncates the size to a ~4 GiB u32 bound, then permits accesses far beyond the real allocation, giving an out-of-bounds read or write into adjacent kernel memory for information disclosure or corruption. No public proof-of-concept is identified at time of analysis.