CVE-2026-45933: Linux Kernel Privilege Escalation Flaw

CVE-2026-45933 Overview

CVE-2026-45933 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) verifier. The flaw resides in the sync_linked_regs() function, which fails to preserve the id of a register when propagating bounds from a linked register. As a result, the verifier loses track of register linkage and can compute incorrect bounds for scalar values. Programs that should be rejected may be accepted, enabling reachable paths such as division by zero that the verifier believes are unreachable.

Critical Impact
Incorrect bounds tracking in the BPF verifier can allow crafted BPF programs to bypass safety checks, leading to kernel-side undefined behavior such as division by zero or out-of-bounds memory access.

Affected Products

Linux kernel versions containing the sync_linked_regs() BPF verifier logic prior to the fix
Distributions shipping affected upstream kernels with unprivileged BPF enabled
Systems exposing BPF program loading to non-root users

Discovery Timeline

2026-05-27 - CVE-2026-45933 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45933

Vulnerability Analysis

The Linux BPF verifier tracks scalar register values using identifiers (id) so that bounds learned about one register can be propagated to other registers linked to it. The sync_linked_regs() helper performs this propagation. The defect occurs when a register chain involves a BPF_ADD_CONST offset.

Consider a sequence where known_reg = reg assigns both registers the same id. A subsequent known_reg += 4 marks known_reg with BPF_ADD_CONST and an off of 4. When sync_linked_regs() then propagates known_reg's refined bounds back to reg, it incorrectly copies the BPF_ADD_CONST state onto reg.

If the program later performs another_reg = reg, the helper assign_scalar_id_before_mov() sees BPF_ADD_CONST on reg and assigns it a new id. This breaks the original linkage between known_reg and reg, so subsequent bound refinements on known_reg no longer reach reg.

Root Cause

The root cause is incomplete state preservation in sync_linked_regs(). The function copies off and subreg_def but does not preserve id, allowing the BPF_ADD_CONST flag and an unintended identifier change to leak onto the target register. This is a logic flaw in verifier state tracking [CWE-682].

Attack Vector

A local user able to load BPF programs can craft a sequence of register moves and constant additions that exploits this propagation bug. The verifier accepts a program in which a runtime branch leads to a division by zero or other unsafe operation that the verifier proved unreachable. This impacts kernel integrity and availability on systems where unprivileged BPF or sufficiently privileged BPF loading is permitted.

No verified exploit code is published with this advisory. Refer to the upstream commits for the precise verifier behavior and reproducer described in the patch series.

Detection Methods for CVE-2026-45933

Indicators of Compromise

Unexpected kernel oops or divide-by-zero faults originating from BPF program execution paths
Repeated BPF program load attempts from non-root users containing arithmetic on linked scalar registers
Kernel logs referencing verifier acceptance followed by runtime BPF JIT exceptions

Detection Strategies

Audit bpf() syscall usage with auditd rules targeting BPF_PROG_LOAD from non-root UIDs
Inspect loaded BPF programs via bpftool prog show and review program origins and capabilities
Monitor for kernel WARN_ON or BUG messages emitted from verifier or JIT code paths

Monitoring Recommendations

Centralize kernel logs and alert on BPF-related panics, oops messages, or unexpected JIT faults
Track processes holding CAP_BPF, CAP_SYS_ADMIN, or CAP_PERFMON and correlate with BPF load activity
Baseline normal BPF program loads per host and flag anomalous spikes from user workloads or containers

How to Mitigate CVE-2026-45933

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits as soon as distribution updates are available
Restrict BPF program loading by setting kernel.unprivileged_bpf_disabled=1 on systems that do not require unprivileged BPF
Reduce the set of users and containers granted CAP_BPF or CAP_SYS_ADMIN

Patch Information

The fix preserves the register id in sync_linked_regs() alongside off and subreg_def. Patches are available in the stable trees as commits 58059335, 65d114b5, 92a8cb18, and af9e89d8. Rebuild and reboot affected kernels after applying the patches.

Workarounds

Disable unprivileged BPF via sysctl -w kernel.unprivileged_bpf_disabled=1 and persist the setting in /etc/sysctl.d/
Use seccomp or LSM policies to block the bpf() syscall for workloads that do not require it
Run untrusted workloads in containers without CAP_BPF and with a restricted seccomp profile

bash

# Disable unprivileged BPF program loading
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-disable-unpriv-bpf.conf

# Verify the setting
sysctl kernel.unprivileged_bpf_disabled