CVE-2026-89579: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89579 Overview

CVE-2026-89579 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) bloom filter map implementation. The flaw resides in bloom_map_alloc() and affects 32-bit kernels when the computed bitmap reaches the U32_MAX fallback case. Two defects combine to allow out-of-bounds memory access: an integer wrap in the allocation size calculation and unsafe interpretation of u32 hash values as signed long bit indices by set_bit() and test_bit(). The vulnerability enables local privilege escalation on 32-bit x86 kernels from a process holding CAP_BPF.

Critical Impact
Local attackers with CAP_BPF can escalate privileges on 32-bit x86 kernels through out-of-bounds writes triggered by BPF bloom filter updates.

Affected Products

Linux kernel BPF subsystem on 32-bit architectures
Linux kernel 32-bit x86 builds exposing CAP_BPF
Stable kernel branches referenced by commits 11c1e83, 272fcb4, 3b7a13e, 80551bf, a6183bc, and dff481e

Discovery Timeline

2026-09-11 - CVE-2026-89579 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89579

Vulnerability Analysis

The BPF bloom filter map allocator contains two 32-bit-specific defects that together produce an exploitable out-of-bounds write primitive. When userspace requests a bloom map whose computed bitmap saturates to U32_MAX, the allocator underestimates the required storage and later writes bit indices that fall outside the allocated region.

The first defect is an arithmetic wrap in BITS_TO_BYTES(U32_MAX). Because DIV_ROUND_UP performs 32-bit addition, the computation wraps and the allocator produces storage large enough only for the fixed-size bloom filter object header. However, bitset_mask remains set to U32_MAX, so subsequent update operations index into memory well past the allocation boundary.

The second defect involves signed interpretation of hash values. BPF bloom hashes are u32, but set_bit() and test_bit() accept a signed long bit number. On x86 32-bit, the bt and bts instructions with a memory operand interpret negative bit offsets relative to the supplied base address. Any hash in the range [0x80000000, U32_MAX] therefore addresses memory before the bitset base, even when a full 512 MiB bitmap has been allocated.

Root Cause

The root cause is a combination of integer overflow in allocation sizing and a type mismatch between the u32 hash domain and the signed long bit-index domain expected by kernel bitops. Neither issue alone is sufficient; together they allow both under-allocation and negative-offset addressing.

Attack Vector

Exploitation requires local code execution on a 32-bit x86 kernel with the CAP_BPF capability. An attacker creates a bloom filter map sized so that bitset_mask becomes U32_MAX, then calls bpf_map_update_elem with crafted values whose hashes fall outside the allocated storage. The resulting out-of-bounds write against adjacent kernel memory can be shaped into local privilege escalation.

The upstream fix splits each hash into a word pointer using BIT_WORD(h) and an in-word bit number bounded to [0, BITS_PER_LONG - 1] before calling set_bit() or test_bit(). The allocator now computes the bitset size from (u64)bitset_mask + 1 before invoking bpf_map_area_alloc(), keeping the addressable bitset consistent with the allocation.

Detection Methods for CVE-2026-89579

Indicators of Compromise

Unexpected bpf(BPF_MAP_CREATE, ...) syscalls creating BPF_MAP_TYPE_BLOOM_FILTER maps with maximal max_entries values from non-root processes holding CAP_BPF
Kernel oops, KASAN reports, or slab corruption warnings originating in bloom_map_alloc or bloom_map_peek_elem
Processes gaining root privileges shortly after invoking BPF map syscalls on 32-bit kernels

Detection Strategies

Audit bpf() syscall telemetry through auditd or eBPF tracing to identify processes creating bloom filter maps with large max_entries parameters
Correlate CAP_BPF grants in container manifests, systemd units, or setcap binaries with subsequent BPF map creation activity
Monitor kernel logs for slab-out-of-bounds and BUG: messages referencing BPF map operations

Monitoring Recommendations

Enable CONFIG_BPF_LSM and load policies restricting bloom filter map creation to trusted workloads
Forward kernel ring buffer output to a centralized log platform and alert on BPF-related crashes
Track uptime and package versions of 32-bit Linux hosts to prioritize patch validation

How to Mitigate CVE-2026-89579

Immediate Actions Required

Apply the stable kernel updates containing commits 11c1e836710d, 272fcb4ba6fa, 3b7a13eccfcf, 80551bf8912c, a6183bc683f9, or dff481e12b3f corresponding to your kernel branch
Restrict CAP_BPF on 32-bit systems to trusted service accounts only
Prioritize patching 32-bit x86 kernels, embedded devices, and legacy build targets where the exploit primitive is realizable

Patch Information

Upstream fixes are available in the Linux stable tree. See the Kernel Stable Commit 11c1e83, Kernel Stable Commit 272fcb4, Kernel Stable Commit 3b7a13e, Kernel Stable Commit 80551bf, Kernel Stable Commit a6183bc, and Kernel Stable Commit dff481e for the fix that hardens sizing and indexing in bloom_map_alloc().

Workarounds

Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged BPF program loading
Remove CAP_BPF from container capability sets and systemd unit AmbientCapabilities where BPF is not required
Where feasible, migrate 32-bit x86 workloads to 64-bit kernels, which are not exposed to the negative bit-offset primitive

bash

# Configuration example
# Disable unprivileged BPF at runtime and persist across reboots
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' > /etc/sysctl.d/10-disable-unpriv-bpf.conf

# Drop CAP_BPF from a systemd unit
# /etc/systemd/system/myservice.service.d/override.conf
# [Service]
# CapabilityBoundingSet=~CAP_BPF
# AmbientCapabilities=