Linux Kernel EUVD-2026-86694

Requires the ability to load eBPF programs into the kernel - normally CAP_BPF or CAP_SYS_ADMIN, or a system where the sysctl kernel.unprivileged_bpf_disabled has been turned off (non-default on modern distros). The attacker must supply a crafted program exercising a BPF_JMP32 not-equal-zero comparison against a register whose lower 32 bits are zero while upper bits are attacker-controlled. Exploitation is local only (AV:L) and needs no user interaction. It is strongly LIMITED by the default posture of disabling unprivileged BPF: on hardened/default hosts an unprivileged user cannot reach the verifier at all, confining realistic risk to multi-tenant nodes, containers, or sandboxes that grant BPF-loading privileges.

This is a genuine BPF verifier soundness bug, not a mislabeled DoS. is_branch_taken() fails to distinguish BPF_JMP (64-bit) from BPF_JMP32 (32-bit) comparisons, so 'if w1 != 0 goto' is mispredicted as always-taken using 64-bit reasoning even though the low 32 bits are zero at runtime. The verifier then treats the fall-through path (pointer += 0xdead000000000000, then dereference) as dead code and skips bounds tracking on it, while at runtime that path IS executed - yielding attacker-controlled out-of-bounds pointer arithmetic and dereference on a map_value, i.e. a controlled arbitrary kernel read/write primitive suitable for LPE rather than a crash-only bug. The provided CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) has a defensible impact tier (C:H/I:H/A:H) but its AC:H is questionable: triggering the misprediction is deterministic once you can load a crafted BPF program, so AC:L is more accurate, pushing real severity toward ~7.8. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so this is not confirmed as exploited in the wild; it should be prioritized on the strength of the primitive and kernel ubiquity, not on observed exploitation. The key limiting signal is privilege: reaching the verifier requires the ability to load BPF programs (CAP_BPF/CAP_SYS_ADMIN, or a non-default unprivileged-BPF configuration), consistent with PR:L and AV:L. Net: real priority for multi-tenant/container hosts that permit BPF loading, lower urgency where unprivileged BPF is disabled (the default).

A local user (or container workload) with BPF-loading capability submits a crafted eBPF program containing a JMP32 not-equal-zero comparison against a register whose low 32 bits are zero but whose upper bits are attacker-chosen; the verifier mispredicts the branch and skips bounds tracking on the live path, accepting an out-of-bounds pointer add and dereference on a map value. At load-and-run time this yields controlled kernel memory read/write that can be developed into privilege escalation. No public exploit code is identified at time of analysis, though the description embeds a concise reproducer program.