Linux Kernel EUVD-2026-86963

Exploitation requires local code execution with the privilege to load eBPF programs - typically CAP_BPF or CAP_SYS_ADMIN, or a system where unprivileged eBPF is enabled (kernel.unprivileged_bpf_disabled=0). The attacker must additionally craft a specific stack-access pattern: a scalar zero spill to the stack, an intervening verifier checkpoint, and a subsequent partial (sub-register) read that leaves part of the slot dead, which is what triggers the faulty STACK_ZERO downgrade. Limiting factors: no remote vector (AV:L), no network exposure, and systems that disable unprivileged BPF and restrict CAP_BPF/CAP_SYS_ADMIN sharply reduce the exposed attacker population; there is no user-interaction requirement (UI:N).

This is a Linux kernel eBPF verifier flaw where __clean_func_state() downgrades a half-dead scalar zero spill to STACK_ZERO, breaking precision-propagation chains in the verifier. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) models a LOCAL, low-privileged attacker achieving availability impact only (C:N/I:N) - i.e. a denial-of-service/kernel-crash profile, NOT remote code execution. Supporting signals point to a low real-world priority: EPSS is 0.16% (4th percentile), there is no CISA KEV listing, and no public PoC is referenced. CONFLICT TO NOTE: the input 'Information Disclosure' tag contradicts the CVSS vector, which sets C:N (no confidentiality impact) - verifier precision bugs can in principle be escalated toward unsafe reads, but the authoritative vector here scopes impact to availability, so the 'Information Disclosure' label should be treated as unverified. Net assessment: a genuine but low-urgency local DoS/correctness bug that matters mainly for multi-tenant or untrusted-eBPF hosts; it is not a widespread-exploitation priority. Verify the true impact class (DoS vs. info-leak) with the kernel maintainers, as the tag and CVSS disagree.

A local, low-privileged user permitted to load eBPF programs (e.g. via CAP_BPF/CAP_SYS_ADMIN or an environment with unprivileged BPF enabled) crafts a BPF program that writes a 64-bit zero spill, passes a verifier checkpoint, then performs a narrow partial read so four bytes become 'dead.' The broken precision propagation causes the verifier to mis-track scalar state, which can lead to acceptance of an otherwise-unsafe program and a resulting kernel availability impact. No public exploit code is identified at time of analysis.