Linux Kernel EUVD-2026-95533

Requires local access with privileges to use the BPF subsystem (typically CAP_BPF or CAP_SYS_ADMIN): the attacker must create/prime a BPF link via bpf_link_prime() AND concurrently read a BPF link iterator (bpf_iter over links) so the iterator takes a reference to a link whose ID is still zero (unsettled). The trigger further depends on anon_inode_getfile() failing during link priming so the creator removes the ID and frees the still-private link, leaving the iterator's reference dangling for the next bpf_link_put(). Limiting factors: it is local-only (not remotely reachable), needs BPF privileges rather than an unprivileged user on default hardened configs, and depends on winning a narrow race window combined with the file-allocation failure path - all of which reduce real-world exploitability below the raw CVSS score.

This is a genuine but access-gated local privilege-escalation risk rather than a mass-exploitation emergency. The input CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) correctly marks it local and privilege-requiring; a slab use-after-free write (KASAN reports 'Write of size 8' in bpf_link_put) in kernel memory is the classic primitive for local privilege escalation, which is why confidentiality, integrity and availability are all High. The real-world exploitation signals are modest and mutually consistent: EPSS is 0.16% (5th percentile) and there is no CISA KEV listing, so this is best classified as 'no public exploit identified at time of analysis' - none of the references (git.kernel.org commits, vuldb, NVD) is flagged as working exploit code. One point of tension to verify: the vuln.today decision label is 'this_week' and the CVSS marks AC:L, yet the description's mechanism is a race between bpf_link_prime() publishing an ID-zero link and anon_inode_getfile() failing - a narrow, timing- and failure-injection-dependent window that in practice raises attack complexity above a straightforward trigger. Net: prioritize patching within the normal fast-track cycle for multi-tenant, container, or untrusted-local-user hosts where BPF privileges are exposed, but this is not a remote or unauthenticated internet-facing threat.

A local actor with BPF privileges (e.g. an attacker who has gained a foothold in a container or on a shared host with CAP_BPF/CAP_SYS_ADMIN) primes a BPF link and arranges for anon_inode_getfile() to fail so the creator frees the still-private link, while concurrently reading a BPF link iterator that has already taken a reference to that ID-zero link. The iterator's next bpf_link_put() then writes into freed slab memory, giving a use-after-free that can be shaped into kernel memory corruption and privilege escalation. No public exploit code is identified at time of analysis, and the attack depends on winning the race window plus forcing the file-allocation failure.