CVE-2026-64353: Linux Kernel Privilege Escalation Flaw

CVE-2026-64353 Overview

CVE-2026-64353 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The flaw resides in the verifier's handling of ARRAY_OF_MAPS lookups when the inner map template is created with the BPF_F_INNER_MAP flag. The verifier incorrectly elides nullness checks on lookup results, relying on the template max_entries value instead of the concrete runtime map bounds. This mismatch can allow out-of-bounds access through crafted BPF programs.

Critical Impact
A local user capable of loading BPF programs may bypass verifier safety checks and access memory outside the intended map bounds, leading to kernel memory corruption or information disclosure.

Affected Products

Linux kernel branches containing the BPF ARRAY_OF_MAPS feature with BPF_F_INNER_MAP support
Distributions shipping affected upstream kernels prior to the referenced stable commits
Systems permitting unprivileged or privileged BPF program loading

Discovery Timeline

2026-07-25 - CVE-2026-64353 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64353

Vulnerability Analysis

The vulnerability affects the BPF verifier's constant-key lookup nullness elision optimization. When a BPF program performs a lookup on an array map using a constant key that fits within max_entries, the verifier normally proves the result cannot be NULL and elides the null check. This optimization is unsafe when applied to ARRAY_OF_MAPS whose inner map template was created with BPF_F_INNER_MAP.

The BPF_F_INNER_MAP flag allows a concrete inner array with a different max_entries value to replace the template at runtime. The verifier reasons about the template dimensions, while the runtime helper enforces the concrete inner map bounds. A key that is in bounds for the template may be out of bounds for the concrete inner map, producing a NULL return that the compiled program does not check.

Root Cause

The root cause is a semantic mismatch between static verifier assumptions and dynamic runtime state. The verifier treats the inner map template's max_entries as authoritative for nullness elision. Because BPF_F_INNER_MAP explicitly permits substitution of the inner map with one of differing size, the template value does not prove key-in-bounds for the concrete map. This is a kernel logic flaw in verifier state tracking [CWE-125 class behavior via missed null check].

Attack Vector

Exploitation requires the ability to load BPF programs and populate an ARRAY_OF_MAPS with an inner map created using BPF_F_INNER_MAP whose max_entries differs from the template. An attacker constructs a program that performs a constant-key lookup where the key exceeds the concrete inner map bounds. The verifier accepts the program and elides the null check, allowing the program to dereference the NULL (or attacker-influenced) result. Detailed reproduction requires examining the upstream fix commits referenced below.

See the upstream patches for technical details: Kernel Git Commit 0b92ad64, Kernel Git Commit 53040a81, and Kernel Git Commit d57db0d9.

Detection Methods for CVE-2026-64353

Indicators of Compromise

Unexpected kernel oops or NULL pointer dereference reports referencing BPF helper functions such as bpf_map_lookup_elem or array_map_lookup_elem.
Loaded BPF programs that reference ARRAY_OF_MAPS with inner maps created using the BPF_F_INNER_MAP flag.
Anomalous bpf() syscall activity from non-administrative user contexts.

Detection Strategies

Audit kernel version strings across the fleet and compare against the upstream stable commits that carry the fix.
Monitor bpf() syscall telemetry with focus on BPF_MAP_CREATE operations specifying BPF_MAP_TYPE_ARRAY_OF_MAPS and inner maps with BPF_F_INNER_MAP.
Correlate BPF program loads with subsequent kernel crashes or dmesg warnings involving map lookup helpers.

Monitoring Recommendations

Enable kernel audit rules for bpf() syscalls and forward events to a central log store.
Track processes that hold CAP_BPF or CAP_SYS_ADMIN and record BPF program load activity.
Watch for repeated crash-loop patterns in workloads that exercise BPF program loading, which may indicate exploitation attempts.

How to Mitigate CVE-2026-64353

Immediate Actions Required

Apply the upstream stable kernel patches referenced by commits 0b92ad64, 53040a81, and d57db0d9 as soon as vendor-packaged updates are available.
Restrict BPF program loading to trusted administrative users by requiring CAP_BPF and disabling unprivileged BPF via kernel.unprivileged_bpf_disabled=1.
Inventory container and Kubernetes workloads that rely on eBPF and validate patch levels of underlying host kernels.

Patch Information

The fix modifies the verifier so that maps marked with BPF_F_INNER_MAP are excluded from lookup-result nullness elision. The patch is available in the upstream stable tree via Kernel Git Commit 0b92ad64, Kernel Git Commit 53040a81, and Kernel Git Commit d57db0d9. Consult your Linux distribution vendor for backported package availability.

Workarounds

Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged BPF program loading.
Remove CAP_BPF and CAP_SYS_ADMIN from workloads that do not require BPF functionality.
Enforce seccomp or Landlock policies that deny the bpf() syscall for untrusted processes.

bash

# Configuration example
# Disable unprivileged BPF program loading persistently
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-disable-unpriv-bpf.conf
sudo sysctl --system

# Verify the setting is active
sysctl kernel.unprivileged_bpf_disabled