CVE-2026-45951: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45951 Overview

CVE-2026-45951 is a use-after-free vulnerability in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. The flaw stems from incorrect refcounting in the check_pseudo_btf_id() function, which can invoke __check_pseudo_btf_id() with a BPF Type Format (BTF) object that holds a zero reference count. An attacker with the ability to load BPF programs can trigger access to freed kernel memory, leading to potential memory corruption or local privilege escalation. The issue has been resolved upstream through three kernel commits that correct the refcount handling and patch related code paths.

Critical Impact
A local attacker capable of loading BPF programs can trigger a use-after-free on a BTF object, potentially leading to kernel memory corruption or privilege escalation.

Affected Products

Linux kernel versions containing the flawed check_pseudo_btf_id() refcount logic in the BPF verifier
Distributions shipping vulnerable upstream kernels prior to the referenced stable commits
Systems permitting unprivileged or privileged BPF program loading

Discovery Timeline

2026-05-27 - CVE-2026-45951 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45951

Vulnerability Analysis

The vulnerability resides in the BPF verifier's handling of BTF objects, which describe kernel type information used by BPF programs to reference kernel symbols safely. The check_pseudo_btf_id() function is responsible for resolving pseudo BTF identifiers in BPF instructions during program verification. Incorrect refcounting allows the inner helper __check_pseudo_btf_id() to execute against a BTF object whose reference count has already reached zero. Operations on that object can therefore touch memory that has been freed or is in the process of being released [CWE-416].

Use-after-free conditions in the kernel BPF subsystem are historically attractive targets because the BPF verifier and JIT run in privileged context. Successful exploitation typically requires shaping kernel heap allocations to control the freed object's contents.

Root Cause

The root cause is improper lifetime management of the btf object passed through check_pseudo_btf_id(). The function failed to take a reference before passing the object to __check_pseudo_btf_id(), so the BTF could be released by a concurrent path while still in use. The upstream fix corrects the refcount accounting and patches related callers. A second revision of the patch also fixed a refcount leak that was introduced during the initial fix iteration.

Attack Vector

Exploitation requires local access and the capability to load BPF programs. On systems where unprivileged BPF is disabled, the attack surface is limited to processes holding CAP_BPF or CAP_SYS_ADMIN. Where unprivileged BPF is enabled, a lower-privileged local attacker can craft a BPF program that references pseudo BTF identifiers in a manner that triggers the faulty refcount path. The vulnerability mechanism is described in the upstream commits; see the Kernel Git Commit for the patch implementing the fix.

Detection Methods for CVE-2026-45951

Indicators of Compromise

Unexpected kernel oops or KASAN reports referencing check_pseudo_btf_id or __check_pseudo_btf_id in the call stack
Kernel panics or memory corruption events occurring during BPF program load on affected kernels
Loading of unusual BPF programs by non-root users on systems with unprivileged BPF enabled

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test and pre-production kernels to catch use-after-free conditions in the BPF verifier
Audit kernel versions across the fleet and flag hosts running kernels before the referenced stable patches
Monitor bpf() syscall usage via audit rules to identify unexpected BPF program loads

Monitoring Recommendations

Collect dmesg and journal entries for BUG:, KASAN:, or general protection fault messages tied to BPF code paths
Track processes invoking bpf(BPF_PROG_LOAD) with auditd and correlate with user privilege levels
Alert on unprivileged users loading BPF programs that reference kernel BTF objects

How to Mitigate CVE-2026-45951

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the kernel.org commits and rebuild or upgrade affected kernels
Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged users from loading BPF programs
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted system accounts only

Patch Information

The fix is delivered through three upstream commits that correct refcount handling in check_pseudo_btf_id() and address a refcount leak introduced during patch iteration. Apply distribution kernel updates that incorporate these commits:

Workarounds

Disable unprivileged BPF loading by setting kernel.unprivileged_bpf_disabled=1 until patches can be deployed
Use seccomp filters or Linux Security Modules (LSMs) such as SELinux or AppArmor to restrict bpf() syscall access
Remove CAP_BPF from container runtimes and workloads that do not require BPF functionality

bash

# Configuration example
# Disable unprivileged BPF program loading at runtime
sysctl -w kernel.unprivileged_bpf_disabled=1

# Persist the setting across reboots
echo 'kernel.unprivileged_bpf_disabled=1' > /etc/sysctl.d/10-disable-unpriv-bpf.conf
sysctl --system