CVE-2026-45886: Linux Kernel Privilege Escalation Flaw

CVE-2026-45886 Overview

CVE-2026-45886 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The flaw resides in the bpf_xdp_store_bytes helper, whose argument prototype was incorrectly declared. The third argument was typed as ARG_PTR_TO_UNINIT_MEM, which carries the MEM_WRITE flag and permits the verifier to treat the buffer as writable. This mismatch allowed the helper to read from uninitialized memory and caused legitimate read-only map usage to fail verification.

The issue was identified while developing Cilium features that required BPF_F_RDONLY_PROG maps. The fix aligns the helper prototype with bpf_skb_store_bytes.

Critical Impact
The incorrect helper prototype permits BPF programs to pass uninitialized memory to bpf_xdp_store_bytes, creating a potential information handling issue inside XDP datapaths.

Affected Products

Linux kernel (BPF / XDP subsystem)
Distributions shipping vulnerable stable kernel branches prior to the listed fix commits
Workloads using bpf_xdp_store_bytes with read-only BPF maps (for example, Cilium-based deployments)

Discovery Timeline

2026-05-27 - CVE-2026-45886 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45886

Vulnerability Analysis

The Linux BPF verifier validates each helper call against the declared argument types. For bpf_xdp_store_bytes, the third argument describes the source buffer that gets copied into the XDP packet. The helper declared this argument as ARG_PTR_TO_UNINIT_MEM, which the verifier interprets as memory that the helper will write to rather than read from.

Two concrete problems result. First, when a BPF program passes a pointer derived from a BPF_F_RDONLY_PROG map, the verifier checks the access via check_mem_size_reg and rejects the call with write into map forbidden, even though the helper only reads the buffer. Second, because ARG_PTR_TO_UNINIT_MEM does not require the buffer to be initialized, the helper can copy uninitialized stack or map memory into the packet.

Root Cause

The root cause is an incorrect helper prototype declaration. bpf_xdp_store_bytes semantically reads from the source buffer and writes into the packet, mirroring bpf_skb_store_bytes. The latter correctly declares its source argument as initialized read-only memory. The fix updates the bpf_xdp_store_bytes_proto definition so that the verifier enforces read semantics and requires initialization on the source buffer.

Attack Vector

Exploitation requires the ability to load a BPF program attached to an XDP hook. On modern kernels this is restricted to privileged contexts such as CAP_BPF or CAP_SYS_ADMIN. A local actor with these capabilities could craft an XDP program that invokes bpf_xdp_store_bytes with an uninitialized stack buffer, causing kernel memory contents to be written into outbound or redirected packets. The verifier blocking read-only maps is a functional defect rather than a direct security boundary, while the uninitialized-read behavior is the security-relevant condition.

No public proof-of-concept is referenced in the advisory. Refer to the patch commits for the verifier interaction details, including kernel.org commit 6557f15 and kernel.org commit d7b87ad.

Detection Methods for CVE-2026-45886

Indicators of Compromise

No file-based or network IOCs are associated with this kernel verifier flaw.
Verifier rejection messages containing write into map forbidden when calling bpf_xdp_store_bytes against a read-only map indicate the vulnerable prototype is in use.
Unexpected non-zero bytes appearing in fields written by bpf_xdp_store_bytes from a stack buffer may indicate the uninitialized-read condition.

Detection Strategies

Inventory kernel versions across Linux hosts and compare against the fixed stable branches referenced in the patch commits.
Audit loaded BPF programs with bpftool prog show and identify those attached to XDP hooks that call bpf_xdp_store_bytes.
Review CI pipelines for Cilium and other XDP-heavy projects for verifier failures tied to read-only map access.

Monitoring Recommendations

Forward kernel logs and auditd BPF events to a central data store for retention and correlation.
Track BPF program load events (BPF_PROG_LOAD) and flag programs that request CAP_BPF or CAP_SYS_ADMIN outside of expected service accounts.
Alert on changes to running kernel versions to confirm patched images are deployed across the fleet.

How to Mitigate CVE-2026-45886

Immediate Actions Required

Apply the upstream stable kernel updates that include the bpf_xdp_store_bytes prototype fix.
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted service accounts and container workloads.
Rebuild and redeploy XDP-based components, including Cilium datapaths, against patched kernels.

Patch Information

The fix is distributed across multiple stable branches. Relevant commits include 0db169a, 57f7f6a, 6557f15, d7b87ad, ddc34a1, and ffb5d1c. The change updates the helper proto to match bpf_skb_store_bytes, enforcing read semantics and requiring initialized source memory.

Workarounds

Avoid calling bpf_xdp_store_bytes with uninitialized stack buffers; zero the buffer before passing it to the helper.
Disable unprivileged BPF where feasible by setting kernel.unprivileged_bpf_disabled=1 via sysctl.
Limit XDP program loading to vetted images and signed BPF objects until patched kernels are rolled out.

bash

# Configuration example
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf-hardening.conf
uname -r   # confirm kernel matches a patched stable release