CVE-2026-45903: Linux Kernel Privilege Escalation Flaw

CVE-2026-45903 Overview

CVE-2026-45903 affects the Linux kernel Berkeley Packet Filter (BPF) subsystem. The verifier started relying on memory access flags in helper function prototypes after commit 37cce22dbd51 ("bpf: verifier: Refactor helper access type tracking"). Several helpers using ARG_PTR_TO_MEM lacked the correct MEM_RDONLY or MEM_WRITE annotations. This omission caused the verifier to incorrectly assume buffer contents remain unchanged across helper calls, potentially optimizing away legitimate reads.

The issue produces correctness problems in BPF programs that rely on data written by helpers such as bpf_get_stack_proto_raw_tp. The fix corrects the access type flags to reflect actual helper behavior.

Critical Impact
The verifier may eliminate reads that follow helper calls, causing BPF programs to observe stale data and produce incorrect runtime behavior in kernel tracing and observability workloads.

Affected Products

Linux kernel versions containing commit 37cce22dbd51 prior to the fix
BPF subsystem helpers using ARG_PTR_TO_MEM without explicit access flags
bpf_get_stack_proto_raw_tp and related raw tracepoint helpers

Discovery Timeline

2026-05-27 - CVE-2026-45903 published to the National Vulnerability Database
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45903

Vulnerability Analysis

The Linux kernel BPF verifier performs static analysis on BPF programs before they execute. After the refactor in commit 37cce22dbd51, the verifier consults helper function prototypes to determine whether a helper reads from or writes to a memory buffer. The verifier uses this information to apply memory access optimizations, including the elimination of redundant loads.

Several helpers declared their buffer arguments using ARG_PTR_TO_MEM without specifying MEM_RDONLY or MEM_WRITE. The verifier interpreted these prototypes as indicating the helper does not modify the buffer. When a BPF program called such a helper and then read from the buffer, the verifier could elide the read and reuse a previously cached value. This contradicts the helper's actual runtime behavior, which writes new data into the buffer.

The bpf_get_stack_proto_raw_tp helper specifically was marked MEM_RDONLY even though it writes stack trace data into its output buffer. The fix changes the annotation to ARG_PTR_TO_UNINIT_MEM, signaling that the helper writes to potentially uninitialized memory.

Root Cause

The root cause is a mismatch between declared and actual memory access semantics in BPF helper prototypes. Helpers that write to caller-provided buffers were declared without the MEM_WRITE flag, causing the verifier's optimization passes to treat buffer contents as immutable across helper invocations. This is a correctness defect in the verifier metadata rather than a memory safety bug in the helper implementations.

Attack Vector

Exploitation requires the ability to load BPF programs into the kernel, typically restricted to privileged users or processes with CAP_BPF or CAP_SYS_ADMIN. A crafted BPF program could trigger the verifier optimization to drop reads of helper output, causing the program to operate on stale data. The primary consequence is incorrect program behavior in tracing, profiling, and observability tooling rather than direct memory corruption.

Similar prototype defects were previously addressed in commits ac44dcc788b9 ("bpf: Fix verifier assumptions of bpf_d_path's output buffer") and 2eb7648558a7 ("bpf: Specify access type of bpf_sysctl_get_name args"). See the kernel commit fdfe75161f6e for the corrective patch.

Detection Methods for CVE-2026-45903

Indicators of Compromise

Unexpected stale or zero values returned by BPF tracing programs invoking stack-capture helpers
BPF programs producing inconsistent output between kernel versions that bracket commit 37cce22dbd51
Tracing tools such as bpftrace, bcc, or perf reporting missing or duplicated stack frames

Detection Strategies

Inventory running kernels and compare against the patched stable branches referenced in the upstream commits
Audit custom BPF programs that consume output from bpf_get_stack_proto_raw_tp for correctness regressions
Compare verifier behavior between pre-patch and post-patch kernels using BPF self-tests in tools/testing/selftests/bpf

Monitoring Recommendations

Track BPF program load events via bpf() syscall auditing using auditd rules on SYS_bpf
Monitor kernel package versions across the fleet to confirm patched builds are deployed
Log invocations of privileged BPF operations and correlate against expected administrative activity

How to Mitigate CVE-2026-45903

Immediate Actions Required

Apply the upstream kernel patches that correct the helper prototypes for affected stable branches
Restrict BPF program loading to trusted accounts by limiting CAP_BPF and CAP_SYS_ADMIN
Set kernel.unprivileged_bpf_disabled=1 on systems that do not require unprivileged BPF

Patch Information

Three corrective commits are published on kernel.org: 802eef5afb18, aa3195928920, and fdfe75161f6e. Update to a kernel build that includes these patches on your distribution's stable branch.

Workarounds

Disable unprivileged BPF program loading via the kernel.unprivileged_bpf_disabled sysctl
Restrict BPF usage to a small set of operator accounts and remove CAP_BPF from general workloads
Avoid relying on output from bpf_get_stack_proto_raw_tp in production observability until the patched kernel is deployed

bash

# Disable unprivileged BPF until kernel is patched
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf.conf

# Verify the running kernel includes the fix
uname -r