Executive brief
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem could allow a local user to bypass security checks. The BPF system uses 'maps' to store data, and a flaw in how the kernel calculates the digital fingerprint (hash) of these maps allows a user to modify data after the fingerprint has been verified. This could lead to the execution of unauthorized or malicious code that appears to be trusted by the system.
Technical details
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the Linux kernel's BPF syscall implementation. Specifically, the function `bpf_map_get_info_by_fd` calculates and caches a SHA256 hash of a BPF map even if the map is not in a frozen (immutable) state. An attacker can exploit this by calling `BPF_OBJ_GET_INFO_BY_FD` to generate and cache a hash, then modifying the map's contents before finally freezing it. This allows the attacker to present a modified map to a trusted loader that relies on the cached, stale hash for verification. The fix introduces a check to ensure the map is frozen before a hash can be requested, returning -EPERM otherwise.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026-02-26 patches
Timeline
- 2026-02-05: disclosed: Initial patch submission by KP Singh
- 2026-02-26: patched: Commits merged into stable trees by Greg Kroah-Hartman and Alexei Starovoitov
- 2026-05-27: advisory: CVE-2026-45927 published by NVD