CVE-2026-45971: Linux Kernel BPF Program DoS Vulnerability

CVE-2026-45971 Overview

CVE-2026-45971 is a resource exhaustion vulnerability in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. The kernel did not enforce an upper bound on the size of BPF program signatures passed from userspace. Attackers could supply excessively large signature size values, forcing the kernel into expensive allocation paths through kmalloc_large or vmalloc. Practical BPF signatures are significantly smaller than KMALLOC_MAX_CACHE_SIZE, so accepting larger values served no legitimate purpose. The fix limits BPF program signature size to prevent abuse of these allocation paths.

Critical Impact
Local users with permission to load BPF programs can trigger costly kernel memory allocations, leading to resource exhaustion conditions on the host.

Affected Products

Linux kernel BPF subsystem (versions including the BPF signature verification feature)
Distributions shipping affected mainline kernel releases
Systems permitting unprivileged or container-based BPF program loading

Discovery Timeline

2026-05-27 - CVE-2026-45971 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45971

Vulnerability Analysis

The Linux kernel BPF subsystem accepts a signature buffer when loading signed BPF programs. The signature size parameter, supplied from userspace, was not capped against a sensible upper limit before allocation. When the requested size exceeded KMALLOC_MAX_CACHE_SIZE, the kernel fell back to kmalloc_large or vmalloc, both of which are significantly more expensive than slab-backed allocations.

An attacker with the ability to invoke the bpf() system call can pass inflated signature size values to force the kernel down these costly paths. Repeated requests amplify CPU and memory pressure, degrading system responsiveness. The condition does not require remote access or memory corruption primitives.

Root Cause

The root cause is missing input validation on the BPF program signature size. The kernel trusted the userspace-supplied length without bounding it against the realistic maximum size of a BPF signature. This permitted allocation requests far larger than any legitimate signature would require.

Attack Vector

Exploitation requires local access and the privileges needed to invoke bpf() with signed program loading. Attackers craft bpf() syscalls that declare oversized signature sizes. The kernel then allocates buffers through vmalloc or kmalloc_large, consuming kernel memory and CPU. Containerized workloads that permit BPF operations expand the exposure surface.

No verified public exploit code is available. The vulnerability is described in the upstream commits referenced by Kernel Git Commit 5835a0, Kernel Git Commit ea1535e, and Kernel Git Commit eb8166c.

Detection Methods for CVE-2026-45971

Indicators of Compromise

Unusual spikes in kernel memory allocations via vmalloc or kmalloc_large correlated with bpf() syscall activity
Sustained CPU consumption in kernel context tied to BPF program loading from unprivileged users or containers
Elevated rates of bpf(BPF_PROG_LOAD, ...) calls from non-administrative processes

Detection Strategies

Audit bpf() syscall invocations using auditd rules and inspect the signature size parameter for outlier values
Monitor /proc/meminfo and slab statistics for abnormal VmallocUsed growth coincident with BPF activity
Correlate process-level CPU usage with BPF load events to identify abuse patterns

Monitoring Recommendations

Enable kernel tracepoints for the BPF subsystem and forward telemetry to a centralized analytics platform
Establish baselines for legitimate BPF program loading frequency per workload and alert on deviations
Track container and namespace contexts that invoke bpf() to attribute anomalous activity to specific tenants

How to Mitigate CVE-2026-45971

Immediate Actions Required

Apply the upstream kernel patches referenced in the commit links above as soon as vendor builds are available
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted system components only
Disable unprivileged BPF program loading by setting kernel.unprivileged_bpf_disabled=1 where operationally feasible

Patch Information

The fix is delivered through three upstream commits that enforce an explicit cap on BPF program signature size. See Kernel Git Commit 5835a0, Kernel Git Commit ea1535e, and Kernel Git Commit eb8166c for the patch series. Rebuild and deploy distribution kernels that incorporate these commits.

Workarounds

Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged users from loading BPF programs
Apply seccomp filters in container runtimes to block the bpf() syscall for workloads that do not require it
Use Linux Security Modules such as SELinux or AppArmor to constrain which processes may invoke BPF operations

bash

# Configuration example
# Disable unprivileged BPF program loading
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo "kernel.unprivileged_bpf_disabled=1" | sudo tee /etc/sysctl.d/90-bpf-hardening.conf

# Verify the setting
sysctl kernel.unprivileged_bpf_disabled