Linux Kernel EUVD-2026-86702

Requires local privileges sufficient to load eBPF programs (CAP_BPF/CAP_SYS_ADMIN, or a kernel configured to allow unprivileged BPF), and specifically the use of a BPF arena pointer with a 32-bit cmpxchg atomic operation that the context-access rewriter converts to BPF_PROBE_ATOMIC. Exploitation is architecture-sensitive - it manifests where 32-bit cmpxchg needs explicit zero extension of the destination register (e.g. x86-64 'lock cmpxchg' not updating %eax on a successful compare). Limiting factors: no remote vector (local only), privileged/config-gated BPF access is normally required, and impact is confined to availability/incorrect computation with no confidentiality or integrity exposure established.

All signals point to a low-to-moderate, locally-scoped reliability bug rather than an urgent priority. The vendor CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a local, low-complexity flaw requiring low privileges, with impact confined to availability (C:N/I:N/A:H) - consistent with a BPF verifier/JIT correctness defect (CWE-681, incorrect numeric conversion) where a 32-bit arena cmpxchg misses the mandatory upper-half zero extension. EPSS is very low (0.15%, 4th percentile), the CVE is NOT in CISA KEV, and no public exploit is identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' These signals are mutually consistent: low EPSS, no KEV, and local-only vector all indicate this is not a widespread exploitation target. One conflict to flag: the input Tag 'Information Disclosure' contradicts the authoritative CVSS impact metrics (C:N, I:N, A:H) and CWE-681 - the vendor-scored impact is availability/incorrect-computation, not confidentiality loss; treat the disclosure label as unverified. Overall this is a high-CVSS-relative-to-real-risk patch-hygiene item for kernel maintainers, not an emergency.

A local user able to load eBPF programs (unprivileged BPF enabled or holding CAP_BPF) crafts a program that performs a 32-bit cmpxchg on a BPF arena pointer; because is_cmpxchg_insn() does not match BPF_PROBE_ATOMIC, the JIT omits the required zero extension of the destination register's upper 32 bits. On architectures like x86-64 where 'lock cmpxchg' leaves %eax unchanged on success, the resulting stale upper bits violate BPF semantics and can lead to incorrect kernel computation or instability. No public proof-of-concept is identified in the provided data.