CVE-2026-45967 Overview
CVE-2026-45967 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The map_direct_value_addr() function of the instruction array map incorrectly adds an offset to the resulting address. The resolve_pseudo_ldimm64() function then adds the offset again, producing an incorrect final address for non-zero offsets in the instruction array. The kernel maintainers have resolved the issue through upstream commits.
Critical Impact
Incorrect address resolution within BPF instruction array maps can result in invalid memory references when programs reference map values at non-zero offsets, affecting BPF program correctness and kernel stability.
Affected Products
- Linux kernel (BPF subsystem)
- Distributions shipping affected kernel versions prior to the fix
- Workloads using BPF instruction array maps with non-zero offset references
Discovery Timeline
- 2026-05-27 - CVE CVE-2026-45967 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45967
Vulnerability Analysis
The defect resides in the BPF instruction array map implementation. The map_direct_value_addr() helper returns a direct address to a map value, used by the verifier when resolving pseudo BPF_LD_IMM64 instructions that reference map values. The function incorrectly factors the caller-supplied offset into its returned address.
Downstream, resolve_pseudo_ldimm64() separately applies the same offset to the address returned by map_direct_value_addr(). The offset is therefore applied twice, producing an address that does not correspond to the intended map element when the offset is non-zero. Programs that load map values at offset zero are unaffected, which is why the bug evaded earlier detection.
For a deeper view of the change, refer to the Kernel.org commit 73ef432 and the Kernel.org commit e3bd7bd.
Root Cause
The root cause is duplicated offset arithmetic across two layers of the BPF verifier and map access logic. map_direct_value_addr() was implemented to return a base address but applied the offset internally, conflicting with the contract expected by resolve_pseudo_ldimm64(), which also applies the offset.
Attack Vector
The vulnerability requires the ability to load BPF programs that reference instruction array map values at non-zero offsets. No public exploit, proof-of-concept, or CISA KEV listing exists for this issue. The upstream commits describe the defect as a correctness bug fixed in the kernel tree, with selftests added in a follow-up commit.
No verified exploitation code is available. See the upstream kernel commits referenced above for the corrective patch and accompanying selftests.
Detection Methods for CVE-2026-45967
Indicators of Compromise
- No public indicators of compromise have been published for CVE-2026-45967.
- Unexpected BPF verifier rejections or anomalous map value reads in kernel logs may indicate exposure to the underlying defect.
Detection Strategies
- Inventory running kernel versions across hosts and compare against the patched commits 73ef432 and e3bd7bd.
- Audit loaded BPF programs that use instruction array maps and reference values with non-zero offsets.
- Monitor dmesg and audit logs for BPF verifier errors associated with BPF_LD_IMM64 instruction resolution.
Monitoring Recommendations
- Track kernel package versions through configuration management and centralized logging.
- Forward kernel and auditd events to a centralized analytics platform for correlation across the fleet.
- Alert on new or modified BPF programs loaded by non-privileged workloads on production hosts.
How to Mitigate CVE-2026-45967
Immediate Actions Required
- Identify Linux systems running kernel versions that predate the upstream fix commits.
- Apply vendor-provided kernel updates that incorporate commits 73ef43202a37d779a8e665a0acae214fa59df9fb and e3bd7bdf5ffe49d8381e42843f6e98cd0c78a1e8.
- Restrict the CAP_BPF and CAP_SYS_ADMIN capabilities to trusted workloads pending patch deployment.
Patch Information
The fix is upstream in the Linux kernel. Reference the Kernel.org commit 73ef432 and the Kernel.org commit e3bd7bd. Consume the patched kernel through your distribution's stable update channel.
Workarounds
- Disable unprivileged BPF program loading by setting kernel.unprivileged_bpf_disabled=1 via sysctl.
- Avoid using non-zero offsets when referencing instruction array map values in BPF programs until patched kernels are deployed.
- Constrain BPF capability grants in container runtimes and Kubernetes pod security policies.
# Configuration example
# Disable unprivileged BPF program loading
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' > /etc/sysctl.d/90-bpf.conf
# Verify current kernel version against patched commits
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
