EUVD-2026-87054
GHSA-5973-rj98-r6wc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local BPF-load privilege
-
DeliveryCraft malicious BPF program with refcount field
-
ExploitVerifier mishandles non-unique bpf_refcount
-
ExecutionTrigger refcount imbalance/UAF
-
ImpactKernel panic (DoS)
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires local access by a principal already authorized to load eBPF programs (PR:L), which on a default modern kernel means CAP_BPF/CAP_SYS_ADMIN or equivalent within the relevant namespace. The vulnerability is in the BPF verifier's handling of the bpf_refcount field not being marked unique, so the attacker must be able to define BPF objects/maps that exercise this refcount path. Limiting factors: no remote vector (AV:L), no code-execution or data-disclosure impact stated (C:N/I:N), impact bounded to availability (A:H), and exploitation is gated behind BPF-loading privileges rather than reachable from an unprivileged default configuration - significantly narrowing realistic exposure to multi-tenant or container hosts that grant BPF capabilities. |
| Impact | This is a genuinely low-priority vulnerability despite its MEDIUM severity rating. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 5.5 and describes a local, low-complexity attack requiring low privileges, with impact limited to availability (C:N/I:N/A:H) - i.e. a kernel crash/denial of service, not code execution or data leakage. The signals are consistent and non-alarming: EPSS is only 0.15% (4th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced. Exploitation status is therefore 'no public exploit identified at time of analysis.' One notable conflict: the 'Information Disclosure' tag directly contradicts the CVSS vector, which assigns C:N (no confidentiality impact) and only A:H - the flaw is an availability/memory-integrity issue in the BPF refcount handling, not an info-leak, so the tag appears mislabeled. Net assessment: a correctness fix for a BPF verifier metadata oversight, realistically a local DoS/potential memory-corruption vector reachable only by a principal already permitted to load BPF programs. Low real-world urgency; patch during normal maintenance cycles. |
| Exploit ScenarioDerived | A local user (or container/process) holding BPF-load privileges crafts a BPF program exploiting the bpf_refcount field not being treated as unique, corrupting reference-count accounting on a kernel object. This leads to a refcount imbalance causing a use-after-free or kernel panic, resulting in denial of service. No public proof-of-concept is referenced, and the attack requires local access with BPF privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
A missing uniqueness annotation on the BPF_REFCOUNT field in the Linux kernel's BPF struct metadata causes the verifier to mis-handle refcounted BPF objects, which a local attacker already authorized to load eBPF programs (PR:L) can abuse to crash or destabilize the kernel, producing a denial-of-service condition (C:N/I:N/A:H, CVSS 5.5). Affected code was introduced with BPF refcount support in Linux 6.4 and persists until the stable fixes shipped in 6.18.52, 7.2.6 and 7.3-rc1; only hosts that grant BPF-loading capabilities (CAP_BPF/CAP_SYS_ADMIN or equivalent in-namespace) are realistically exposed, which narrows practical risk to multi-tenant and container hosts. There is no remote vector, no disclosure or integrity impact, and no public exploit identified at time of analysis; EPSS is 0.15% (4th percentile), consistent with a genuinely low-priority issue despite the MEDIUM severity score, and no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: apply the upstream fixes and move to Linux 6.18.52, Linux 7.2.6 or Linux 7.3-rc1 (or any later release containing the fix), which correspond to the stable commits https://git.kernel.org/stable/c/61e655391cb19c31f94ecd4354f624c81ce4cf75, https://git.kernel.org/stable/c/e42cede6f90177f4f92f80d3de18f628e61d2087 and https://git.kernel.org/stable/c/641f814965d733936ca3618d4d5a12a8fa9be00e; distribution kernels should be updated to the vendor build that backports one of these commits, and the advisory entry is at https://nvd.nist.gov/vuln/detail/CVE-2026-100074. Because exploitation is gated behind local BPF-loading privilege (AV:L/PR:L), the strongest compensating control is to withhold that privilege: remove CAP_BPF and CAP_SYS_ADMIN from container workloads and unprivileged users, which is effective but breaks legitimate eBPF tools such as Cilium, Falco, Tetragon and observability agents that need to load programs. Where unprivileged BPF is enabled, setting kernel.unprivileged_bpf_disabled to 1 (runtime, revertible) or 2 (permanent until reboot) blocks unprivileged bpf() loads at the cost of disabling unprivileged BPF tooling and requiring a reboot for mode 2; per-container seccomp/AppArmor denials of the bpf() syscall give finer granularity but must be tested against existing workloads. If patching must be deferred, monitor for kernel oops/panic events attributable to BPF object lifecycle at the host and container level, since the impact here is availability only and no data exposure or integrity loss is expected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Linux kernel's BPF subsystem supports refcounted kernel pointers (bpf_obj_new / bpf_obj_drop, BPF_REFCOUNT) so that BPF programs can allocate and safely share objects with reference counting. During BTF field parsing and verification, the verifier classifies special fields inside structs a BPF program may access (spin locks, timers, kptrs, list/rb nodes, refcounts) and relies on a 'unique' marking to know that a given field must be treated as a single, non-aliased special field rather than an ordinary data field. The BPF_REFCOUNT field type was not registered as unique, an oversight corrected by this change; without that marking, the verifier's handling of refcounted objects diverges from the intended invariant, allowing memory/refcount state to be manipulated in ways the verifier should have rejected. The root-cause class is a verifier metadata/annotation defect rather than a classic memory-safety bug, and its observable consequence in this assessment is bounded to availability (OS/object lifecycle corruption leading to kernel fault or crash) with no stated confidentiality or integrity impact. The CPE cpe:2.3:a:linux:linux:* indicates the upstream Linux kernel tree as the affected product, with the vulnerable code present from the 6.4 development line onward and fixed by the stable-branch commits referenced in the advisory (61e655391cb19c31f94ecd4354f624c81ce4cf75, e42cede6f90177f4f92f80d3de18f628e61d2087, 641f814965d733936ca3618d4d5a12a8fa9be00e). Exploitation is gated behind the ability to load BPF programs: the assessed vector carries AV:L/PR:L, meaning a local principal with the requisite BPF capability, and no unauthenticated or remote path is described.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local BPF-load privilege is required (PR:L, AV:L); the refcount flaw yields a kernel DoS with no confidentiality or integrity impact (C:N/I:N/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark bpf_refcount field as unique
BPF_REFCOUNT is not marked as a unique field, while it should be. Fix this oversight.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB