Linux Kernel EUVD-2026-95531

Exploitation requires the ability to load eBPF programs and create BPF maps on the target (typically CAP_BPF/CAP_SYS_ADMIN or a configuration permitting such map operations), and specifically the use of a map-in-map (array-of-maps) whose inner-map template is a percpu array; the attacker must then replace that inner map with one having a smaller max_entries, which the generic bpf_map_meta_equal() check fails to reject. The out-of-bounds access only occurs because percpu_array_map_gen_lookup() inlines the original template's index_mask as a JIT immediate, so the condition is tied to this specific percpu-array inner-map replacement path. Limiting factors: no remote vector (local only), privileges to manipulate BPF maps are required, and systems that forbid unprivileged BPF or do not use percpu-array inner maps are not reachable. Updating the kernel to include the referenced fix commit is the remediation stated by the source.

Signals are consistent and point to a genuine but non-urgent local-privilege kernel issue rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, 7.8 HIGH) describes a locally-triggered flaw that already requires some privilege, so it is not remotely reachable. EPSS is very low (0.15%, 3rd percentile) and the CVE is not listed in CISA KEV, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_week', indicating a patch-this-cycle priority, not an emergency - which aligns with the low EPSS and the local, privilege-gated vector. No SSVC automatable/technical-impact fields were supplied, so that framework cannot be cross-referenced. Net: this is a real memory-safety defect in the eBPF verifier/map subsystem worth patching on a normal cycle, not a high-CVSS-but-hollow finding, but also not an actively exploited emergency. Note one metadata conflict: the input Tags label this 'Authentication Bypass', which the description does not support - it is an out-of-bounds access via inner-map replacement, not an auth bypass.

A local actor able to load eBPF programs and create maps sets up a map-in-map (array-of-maps) whose inner-map template is a percpu array, then swaps in a replacement percpu array with fewer max_entries, which the generic metadata check fails to reject. Because percpu_array_map_gen_lookup() has inlined the original template's index_mask as a JIT immediate, a subsequent lookup on the smaller replacement map indexes pptrs[] out of bounds, yielding kernel memory corruption or disclosure. No public exploit code is identified at time of analysis.