Executive brief
The Linux kernel's eBPF (Extended Berkeley Packet Filter) subsystem is used to run sandboxed programs in kernel space for monitoring and networking. A vulnerability in the signed loader's validation of eBPF metadata maps allows an attacker with local access to bypass signature verification by loading maps that are not exclusive, enabling arbitrary program behavior and potential privilege escalation or data manipulation.
Technical details
The vulnerability is a validation bypass in the libbpf signed loader's metadata map verification logic. The loader verifies map SHA256 hashes against signed metadata, but failed to enforce that maps must be exclusive (BPF_F_SHARED cannot be set). Without this check, a hostile host can omit the exclusive flag when loading the signed loader, allowing concurrent BPF programs to mutate map contents between hash verification and loader execution, causing the signature check to pass on stale data. The fix adds an exclusivity validation check in emit_signature_match() before proceeding with SHA256 verification. Local privilege is required to load BPF programs and maps.
Affected products
- Linux Linux kernel multiple versions through 2026-06-01
Timeline
- 2026-08-28: disclosed: Published in NVD
- 2026-06-01: patched: Upstream fix committed by KP Singh and Daniel Borkmann