CVE-2026-45839: Linux Kernel Privilege Escalation Flaw

CVE-2026-45839 Overview

CVE-2026-45839 is an out-of-bounds read vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) CO-RE (Compile Once - Run Everywhere) relocation handling. The function bpf_core_parse_spec() parses colon-separated accessor strings using sscanf("%d"), silently accepting negative integers. Subsequent bounds checks fail to catch negative values because C integer promotion converts the __u16 result of btf_vlen() to int, making the comparison evaluate as false for any negative index. A crafted BPF program with a negative CO-RE accessor triggers a deterministic kernel page fault during BPF_PROG_LOAD. The bug is reachable by any process holding CAP_BPF.

Critical Impact
A local attacker with CAP_BPF can crash the kernel deterministically on any distribution shipping with CONFIG_DEBUG_INFO_BTF=y, which is the default on major distributions.

Affected Products

Linux kernel versions containing the BPF CO-RE relocation code in kernel/bpf/btf.c and tools/lib/bpf/relo_core.c
Systems built with CONFIG_DEBUG_INFO_BTF=y (default on major distributions including Ubuntu, Fedora, RHEL, Debian)
Kernels where unprivileged processes have been granted CAP_BPF

Discovery Timeline

2026-05-27 - CVE-2026-45839 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45839

Vulnerability Analysis

CO-RE accessor strings encode a path from a root BTF (BPF Type Format) type to a target field as colon-separated indices, for example "0:1:2" to walk through nested struct members. The kernel parses each component via sscanf("%d", ...), which accepts negative integers without complaint. The accessor indices are then validated against btf_vlen(t), which returns an unsigned 16-bit value representing the count of struct members, array elements, or enumerator values.

The comparison access_idx >= btf_vlen(t) only guards the upper bound. C integer promotion widens the __u16 return value of btf_vlen() to int, so a signed -1 compares as less than any positive bound and passes validation. The negative index then flows into btf_member_bit_offset(), where it is cast to u32 0xffffffff, indexing far past the members array and triggering an out-of-bounds read.

Root Cause

The root cause is missing input validation on signed integers parsed from user-supplied CO-RE relocation specifications. CO-RE accessor indices are semantically non-negative because they represent struct member, array element, or enumerator positions. The parser failed to reject negative values immediately after sscanf() returned them, and the downstream bounds check was undermined by implicit signed-to-unsigned conversion.

Attack Vector

An attacker with CAP_BPF loads a crafted BPF program containing a CO-RE relocation that references a negative accessor index on any struct present in vmlinux BTF, such as task_struct. During BPF_PROG_LOAD, the verifier invokes bpf_core_apply(), which calls bpf_core_parse_spec() and ultimately btf_member_bit_offset() with the attacker-controlled negative index. The resulting page fault crashes the kernel.

The published call stack illustrates the path: bpf_prog_load → bpf_check → check_core_relo → bpf_core_apply → bpf_core_calc_relo_insn → bpf_core_parse_spec, terminating in a supervisor read access page fault at an address derived from the unsigned cast of the negative index.

No verified public exploit code is available. See the upstream commits referenced below for technical details of the fix.

Detection Methods for CVE-2026-45839

Indicators of Compromise

Unexpected kernel Oops or page fault entries in dmesg or /var/log/kern.log referencing bpf_core_parse_spec or bpf_core_calc_relo_insn.
KASAN reports citing out-of-bounds reads in kernel/bpf/btf.c or tools/lib/bpf/relo_core.c.
System crashes or reboots coincident with bpf() syscall activity from non-root processes.

Detection Strategies

Audit processes and containers granted CAP_BPF and monitor calls to bpf(BPF_PROG_LOAD, ...) via auditd rules.
Inspect loaded BPF programs and their associated BTF blobs for malformed CO-RE relocation entries containing negative accessor indices.
Correlate kernel crash dumps with the BPF load events that preceded them to identify the originating program and process.

Monitoring Recommendations

Enable auditd rules for the bpf syscall to capture program type, license, and invoking UID.
Forward kernel ring buffer messages and crash logs to a centralized log store for retention and analysis.
Track which workloads load eBPF programs from untrusted sources, including third-party observability and networking agents.

How to Mitigate CVE-2026-45839

Immediate Actions Required

Apply the upstream Linux kernel patches that reject negative CO-RE accessor indices in bpf_core_parse_spec() once they are included in your distribution's stable kernel.
Restrict CAP_BPF to trusted system components and remove it from container runtimes and unprivileged users where possible.
Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged BPF program loading.

Patch Information

The fix rejects negative accessor indices immediately after sscanf() parsing in bpf_core_parse_spec(). The upstream commits are available at Kernel Git Commit 1c22483, Kernel Git Commit 36a9012, Kernel Git Commit 3ff85ae, Kernel Git Commit 76f2eba, and Kernel Git Commit 99dbab7. Track your distribution's security advisories for backported stable kernel releases.

Workarounds

Disable unprivileged BPF program loading by setting kernel.unprivileged_bpf_disabled=1.
Drop CAP_BPF and CAP_SYS_ADMIN from container security profiles unless explicitly required by the workload.
Use seccomp filters to block the bpf() syscall for processes that do not need it.

bash

# Configuration example
# Disable unprivileged BPF at runtime
sysctl -w kernel.unprivileged_bpf_disabled=1

# Persist across reboots
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-disable-unpriv-bpf.conf
sudo sysctl --system

# Verify
sysctl kernel.unprivileged_bpf_disabled