Linux Kernel EUVD-2026-82252

Requires local capability to load and run eBPF programs - CAP_BPF (plus CAP_SYS_ADMIN/CAP_PERFMON depending on program type), or a system with unprivileged BPF enabled (kernel.unprivileged_bpf_disabled=0). The attacker's program must use an untrusted-BTF-pointer helper such as bpf_rdonly_cast() and then perform a write, which the pre-fix verifier accepts through the btf_struct_access callback before the default read-only rejection. Affected kernels are v6.2 through the fix (base commit 282de143ead9); systems already on 7.2.6, 7.3-rc1, or with the backport are not affected. Limiting factors: no remote vector (AV:L), no user interaction, and the CAP_BPF/unprivileged-BPF gate means hardened hosts that disable unprivileged BPF and restrict CAP_BPF are not exposed.

This is a genuine kernel write primitive, not a crash-only bug, which places it above most of its BPF sibling CVEs. The verifier's check_ptr_to_btf_access() allowed program-type btf_struct_access callbacks to validate writes BEFORE the default BTF access path rejected non-read accesses, bypassing the read-only policy for PTR_UNTRUSTED pointers produced by helpers like bpf_rdonly_cast(). Because bpf_rdonly_cast() casts an arbitrary/attacker-influenced value into a typed BTF pointer, permitting writes through it yields a controlled kernel memory write suitable for local privilege escalation. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) is broadly defensible for a write primitive, though PR:L is doing important work: exploitation requires the ability to load and run eBPF programs (CAP_BPF/CAP_SYS_ADMIN or an unprivileged-BPF-enabled system). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is a latent primitive, not a confirmed campaign. Net: a real priority for multi-tenant/container hosts that grant CAP_BPF, but the local-plus-capability gate keeps it well below a remote-unauth critical.

A local attacker with the ability to load eBPF programs (CAP_BPF) writes a program that uses bpf_rdonly_cast() to obtain an untrusted BTF pointer, then issues a write through it that the verifier wrongly accepts via the btf_struct_access callback path. By steering the cast pointer at chosen kernel memory, the attacker corrupts kernel state (e.g., credential structures or function pointers) to escalate to root. No public exploit code is identified in the provided data.