Linux Kernel EUVD-2026-86982

Requires local ability to load eBPF programs, which in practice means unprivileged eBPF must be permitted (e.g. kernel.unprivileged_bpf_disabled=0) or the actor must already hold CAP_BPF/CAP_SYS_ADMIN - a significant limiting factor because most modern distributions ship unprivileged eBPF disabled by default. The specific trigger is a crafted BPF program performing pointer arithmetic (dst_reg += bounded scalar) on a PTR_TO_MAP_VALUE register that drives the verifier down the speculative sanitize_ptr_alu() path. Impact is bounded to a kernel WARN splat unless the system is configured with panic_on_warn, in which case it escalates to a full denial of service; there is no network vector and no confidentiality/integrity consequence.

All signals point to a low-to-moderate, availability-only local issue rather than a priority threat. The provided CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5 Medium) describes a locally-reachable flaw requiring low privileges, with no confidentiality or integrity impact and only availability impact - consistent with CWE-617 (reachable assertion / verifier WARN). EPSS is very low at 0.16% (4th percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis'. These signals are mutually consistent (low EPSS, no KEV, local-only, availability-only) - there is no conflict suggesting hidden severity. One nuance to verify: the input Tags label this 'Information Disclosure', but the CVSS vector sets C:N and the root cause is a false-positive verifier invariant warning on a safe program, which maps to denial of service (A:H), not disclosure - treat the 'Information Disclosure' label as unreliable. Realistically this is a code-correctness/robustness fix in the eBPF verifier whose practical impact is a kernel WARN splat (crash only if panic_on_warn is set), reachable only where unprivileged eBPF is permitted. It is a legitimate fix but not an urgent, widely-exploited priority.

A local unauthenticated-in-the-kernel-sense but low-privileged user on a system that permits unprivileged eBPF loads a crafted BPF program performing speculative pointer arithmetic on a PTR_TO_MAP_VALUE register. The verifier's speculative-path handling snapshots an inconsistent register state (var_off out of sync with the 32-bit range), tripping reg_bounds_sanity_check() and emitting a REG INVARIANTS VIOLATION WARN, which becomes a denial of service on kernels configured with panic_on_warn. No public exploit code is referenced in the provided data.