Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) subsystem enforces access controls on exclusive maps through a program verification step. However, BPF map element iterators bypass this check by binding to maps at runtime rather than through the normal program loading path, allowing unauthorized programs to access and modify data in exclusive maps that should be restricted to a single authorized program.
Technical details
This vulnerability is a security control bypass in the eBPF/BPF subsystem. Exclusive maps (excl_prog_hash) are designed to be accessible only by a single authorized program whose cryptographic hash matches. The exclusivity check is normally enforced by check_map_prog_compatibility() when a program references the map during loading. However, bpf_map_elem iterators attach to their target maps at runtime via bpf_iter_attach_map() instead of referencing them through the program, circumventing the exclusivity validation. Additionally, iterators expose map values as writable buffers, compounding the exposure. The fix adds an explicit exclusivity check in bpf_iter_attach_map() to reject attachment when a map has the excl_prog_sha field set, returning -EPERM on violation. No authentication or user interaction is required; any unprivileged BPF program capable of using iterators can exploit this on vulnerable kernels.
Affected products
- Linux Linux Kernel versions prior to fix commit 3c56ee343f9412d81918635c3e25e22a5dd6d87e (approximately 5.12 and later, backported to stable branches)
Timeline
- 2026-08-15: disclosed: Published by NVD
- 2026-06-02: patched: Fix committed upstream by Daniel Borkmann