CVE-2026-80675: Linux Kernel BPF Privilege Escalation Flaw

CVE-2026-80675 Overview

CVE-2026-80675 is a Linux kernel vulnerability in the libbpf signed loader component. The signed loader verifies map->sha against the metadata hash contained in its instructions, but it previously accepted non-exclusive metadata maps. A hostile host could omit the exclusivity flag when loading the loader, permitting another Berkeley Packet Filter (BPF) program with map access to mutate map contents after freezing. The verification check then passes on stale data, undermining the integrity guarantees the signed loader is meant to provide.

Critical Impact
A local attacker with the ability to load BPF programs can bypass signed loader integrity checks and mutate metadata map contents, compromising confidentiality and integrity of BPF program state.

Affected Products

Linux kernel libbpf signed loader
Kernel builds prior to commits 0dad5ad, 0fb6c9e, and b6862b6
Distributions shipping the affected libbpf signed loader path

Discovery Timeline

2026-08-28 - CVE-2026-80675 published to the National Vulnerability Database (NVD)
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80675

Vulnerability Analysis

The Linux kernel's libbpf signed loader implements a chain of trust for BPF programs by hashing metadata maps and validating them against values embedded in the loader instructions. The check runs when BPF_OBJ_GET_INFO_BY_FD is invoked on a frozen map, at which point map->sha is calculated and compared to the expected hash.

Freezing prevents further writes through the file descriptor that froze the map. However, freezing alone does not guarantee that only the signed loader can access the map. If a map is not marked exclusive, a separate BPF program that already holds a reference can still mutate its contents after the hash is computed. The signed loader therefore validates a value that no longer reflects the actual runtime state of the map.

An attacker exploiting this Time-of-Check Time-of-Use (TOCTOU) window can substitute attacker-controlled data into what the loader considers verified metadata. This defeats the integrity model of the signed loader and can lead to loading of BPF programs that behave differently than their signed manifest describes.

Root Cause

The root cause is a missing exclusivity check in the signed loader path. The loader trusted the host to configure the map correctly rather than enforcing exclusivity itself. The patches add a check so the signed loader refuses to proceed with map->sha validation when the host has not marked the metadata map exclusive.

Attack Vector

Exploitation requires local access with the ability to load BPF programs, generally implying CAP_BPF or equivalent privileges on the target system. An adversary sets up the signed loader with a non-exclusive metadata map, allowing a second BPF program to alter map contents after the loader's hash validation, resulting in high impact to confidentiality and integrity of program state.

No verified public exploit code is available. Technical details are described in the upstream commits referenced by Kernel Git Commit 0dad5ad, Kernel Git Commit 0fb6c9e, and Kernel Git Commit b6862b6.

Detection Methods for CVE-2026-80675

Indicators of Compromise

Unexpected loading of BPF programs that reference metadata maps without the exclusive flag set.
Repeated BPF_OBJ_GET_INFO_BY_FD calls on frozen maps followed by writes from a secondary BPF program holding the same map file descriptor.
Presence of custom or unsigned BPF loaders on production hosts where only vendor-signed BPF should run.

Detection Strategies

Audit kernel and userspace logs for BPF syscall activity, correlating bpf(BPF_PROG_LOAD), bpf(BPF_MAP_FREEZE), and bpf(BPF_OBJ_GET_INFO_BY_FD) sequences that do not originate from expected system components.
Baseline the set of processes permitted to invoke BPF syscalls and alert on deviations, especially non-root or newly introduced binaries with CAP_BPF.
Track kernel version and package inventory to identify hosts still exposed to the pre-patch libbpf signed loader.

Monitoring Recommendations

Enable kernel audit rules covering the bpf syscall family and forward events to a centralized log pipeline.
Monitor for the loading of BPF programs referencing metadata maps that lack the BPF_F_EXCLUSIVE semantics enforced by the patch.
Alert on privilege changes that grant CAP_BPF or CAP_SYS_ADMIN outside change-management windows.

How to Mitigate CVE-2026-80675

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 0dad5ad, 0fb6c9e, and b6862b6 as soon as vendor-supported builds become available.
Restrict the set of accounts and workloads permitted to load BPF programs to trusted operators and signed system tooling.
Inventory hosts running the affected libbpf signed loader and prioritize patching on multi-tenant systems and shared infrastructure.

Patch Information

The fix requires the signed loader to reject non-exclusive metadata maps before performing map->sha validation. Vendors should backport the three upstream commits into supported stable branches. Consult distribution security advisories for kernel package versions that include the fix, and rebuild any out-of-tree kernel modules dependent on libbpf internals.

Workarounds

Disable or restrict use of the libbpf signed loader on systems where it is not required until a patched kernel is deployed.
Enforce CAP_BPF reduction using Linux Security Modules such as SELinux or AppArmor to limit which processes can load BPF programs.
Use lockdown mode or seccomp profiles on sensitive workloads to block direct invocation of the bpf syscall by untrusted code.

bash

# Configuration example: restrict BPF syscall access via sysctl
# Requires kernel with unprivileged BPF disabled
sysctl -w kernel.unprivileged_bpf_disabled=1

# Verify current state
sysctl kernel.unprivileged_bpf_disabled

# Audit BPF syscall usage with auditd
auditctl -a always,exit -F arch=b64 -S bpf -k bpf_syscall_activity