CVE-2026-45837: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45837 Overview

CVE-2026-45837 is a use-after-free vulnerability in the Linux kernel's BPF arena subsystem. The flaw resides in arena_vm_close() and manifests when a process holding a BPF arena Virtual Memory Area (VMA) is forked. The arena_vm_open() callback increments vml->mmap_count but never registers the child VMA in arena->vma_list, leaving vml->vma permanently pointing at the parent VMA. After the parent calls munmap(), the pointer dangles. A subsequent bpf_arena_free_pages() call from the child triggers zap_pages(), which dereferences the stale vml->vma pointer.

Critical Impact
A local unprivileged process with access to a BPF arena can trigger kernel memory corruption through a fork-and-munmap sequence, potentially enabling local privilege escalation.

Affected Products

Linux kernel versions containing the BPF arena implementation prior to the patched commits
Distributions shipping affected upstream kernels
Systems exposing BPF arena functionality to unprivileged or sandboxed workloads

Discovery Timeline

2026-05-27 - CVE-2026-45837 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45837

Vulnerability Analysis

The Linux kernel BPF arena allows BPF programs and userspace to share a memory region for high-performance data exchange. The kernel registers VMA operations including open, close, and mremap callbacks to manage the lifecycle of this shared region. When a process with a mapped BPF arena calls fork(), the kernel duplicates the parent's VMAs through vm_area_dup() and invokes the registered vm_ops->open() callback on each copy.

The arena_vm_open() implementation increments the reference counter vml->mmap_count but fails to insert the new child VMA into arena->vma_list. The vml->vma field continues to reference the parent VMA. When the parent later unmaps its arena region, arena_vm_close() frees parent-specific state, leaving the child's vml->vma pointer dangling.

If the child subsequently invokes bpf_arena_free_pages(), the kernel calls zap_pages() which reads the stale vml->vma pointer. This dereference of freed memory corrupts kernel state and can be leveraged for privilege escalation [CWE-416].

Root Cause

The root cause is incomplete state management in the VMA open callback. The arena code assumed a single VMA per vml structure but did not enforce that invariant during fork or mremap. The may_split callback was also missing, allowing operations that could split the VMA. A same-size mremap(MREMAP_FIXED) reaches copy_vma() through check_prep_vma(), which returns early when new_len == old_len and skips the VM_DONTEXPAND check, exposing the same dangling pointer pattern.

Attack Vector

A local attacker with permission to create BPF arena mappings forks the process, unmaps the parent's arena region, and then invokes bpf_arena_free_pages() from the child. The resulting use-after-free in zap_pages() corrupts kernel memory. Exploitation requires local code execution and access to the BPF arena interface, which is typically restricted to privileged users but may be reachable from container or sandbox escapes.

The upstream fix marks the arena VMA with VM_DONTCOPY to prevent inheritance across fork, installs a may_split callback to reject splits, and registers an mremap callback that returns -EINVAL. The reference count ensures rollback paths do not prematurely free the shared vml structure.

Detection Methods for CVE-2026-45837

Indicators of Compromise

Kernel oops or panic logs referencing arena_vm_close, bpf_arena_free_pages, or zap_pages in the call trace
KASAN reports identifying use-after-free reads on VMA structures associated with BPF arena
Unexpected process crashes in workloads using BPF arena shortly after fork operations

Detection Strategies

Audit kernel versions across the fleet using package inventory data to identify hosts running unpatched kernels with BPF arena support compiled in
Enable KASAN and lockdep on test kernels to surface use-after-free conditions during fuzzing of BPF arena workloads
Monitor auditd for bpf() syscall invocations followed by fork() and munmap() patterns from non-root contexts

Monitoring Recommendations

Forward kernel ring buffer (dmesg) and /var/log/kern.log to centralized logging for analysis of stack traces involving BPF arena symbols
Track BPF program load events and arena map creation through bpftool or eBPF-based telemetry
Alert on kernel crashes correlating with processes that recently executed bpf(BPF_MAP_CREATE) for arena maps

How to Mitigate CVE-2026-45837

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 201128fc, 4fddde2a, 723b9fa9, and d18099f1 to all affected systems
Restrict BPF arena access by enforcing kernel.unprivileged_bpf_disabled=1 until patched kernels are deployed
Inventory containerized workloads that grant CAP_BPF or CAP_SYS_ADMIN and reduce capability grants where possible

Patch Information

The fix has landed upstream across multiple stable branches. Reference the following commits: Kernel Commit 201128fc Patch, Kernel Commit 4fddde2 Patch, Kernel Commit 723b9fa Patch, and Kernel Commit d18099f1 Patch. The patches add VM_DONTCOPY, a may_split callback, and an mremap callback returning -EINVAL.

Workarounds

Disable unprivileged BPF system-wide by setting kernel.unprivileged_bpf_disabled=1 via sysctl
Remove CAP_BPF and CAP_SYS_ADMIN from container runtime defaults where BPF arena is not required
Use seccomp filters to block the bpf() syscall in workloads that do not legitimately require it

bash

# Configuration example
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/99-bpf-hardening.conf
sudo sysctl --system