CVE-2026-89799: Linux Kernel BPF Privilege Escalation Flaw

CVE-2026-89799 Overview

CVE-2026-89799 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The flaw resides in the bpf_get_stackid helper, which calls get_perf_callchain without disabling preemption. The kernel must keep preemption disabled while accessing the trace entries buffer returned by get_perf_callchain. Failing to do so can lead to race conditions and memory corruption when the executing task is rescheduled onto another CPU.

Critical Impact
A local, low-privileged user able to load or invoke eligible BPF programs can trigger kernel memory corruption, resulting in privilege escalation, information disclosure, or a system crash.

Affected Products

Linux kernel versions containing the pre-patch bpf_get_stackid implementation
Distributions shipping unpatched upstream kernels with BPF perf event support enabled
Systems allowing unprivileged or CAP_BPF-holding users to attach BPF programs to perf events

Discovery Timeline

2026-09-16 - CVE-2026-89799 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89799

Vulnerability Analysis

The defect is a preemption-handling flaw in the BPF stack unwinding path. bpf_get_stackid invokes get_perf_callchain to capture a call chain and then reads from the returned per-CPU trace entries buffer. Both operations require preemption to remain disabled so that the executing task cannot migrate to a different CPU between the call chain capture and its consumption.

Without that guarantee, the kernel may access a stale or reused per-CPU buffer. Concurrent BPF invocations on the original CPU can overwrite the buffer while the original context still reads it. This creates a classic race condition against per-CPU state and can corrupt kernel memory. The related bpf_get_stackid_pe variant is not affected because its callers already run with preemption disabled.

Root Cause

The root cause is missing preemption control around a helper that operates on per-CPU data. The bpf_get_stackid implementation did not wrap the get_perf_callchain call and the subsequent buffer access with preempt_disable() and preempt_enable(). This is a race condition class defect ([CWE-362]) affecting kernel data integrity.

Attack Vector

Exploitation requires local access and the ability to attach or invoke a BPF program that calls the bpf_get_stackid helper. An attacker schedules concurrent workloads that trigger the helper on the same CPU while forcing preemption of the running task. The resulting per-CPU buffer race can be shaped to overwrite adjacent kernel memory, enabling privilege escalation or leakage of kernel data. The remote attack surface is not applicable; the flaw is exploited from a local user context.

No public proof-of-concept has been published for this CVE. Refer to the upstream fixes for technical detail: Kernel Git Commit 15f1bd8, Kernel Git Commit c4efdc1d, and Kernel Git Commit ccf481d7.

Detection Methods for CVE-2026-89799

Indicators of Compromise

Unexpected kernel oops or panic messages referencing bpf_get_stackid, get_perf_callchain, or perf_callchain_entry in dmesg or /var/log/kern.log.
KASAN reports flagging use-after-free or out-of-bounds access in the BPF stackmap code path.
Sudden SIGKILL or process termination correlated with BPF program loads by non-root users.

Detection Strategies

Audit loaded BPF programs with bpftool prog show and flag programs of type BPF_PROG_TYPE_PERF_EVENT or BPF_PROG_TYPE_KPROBE calling helper ID 27 (bpf_get_stackid).
Enable CONFIG_KASAN on test kernels to surface race-triggered memory corruption during regression testing.
Monitor auditd for bpf() syscalls from unprivileged UIDs, particularly BPF_PROG_LOAD and BPF_PROG_ATTACH operations.

Monitoring Recommendations

Ingest kernel logs into a centralized logging platform and alert on BPF verifier warnings or kernel stack traces containing stackmap symbols.
Track sysctl kernel.unprivileged_bpf_disabled values across the fleet and alert on hosts where it is set to 0.
Correlate elevated CPU migration and reschedule events with BPF syscall activity from the same process context.

How to Mitigate CVE-2026-89799

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the NVD entry and reboot affected hosts.
Set kernel.unprivileged_bpf_disabled=1 to prevent unprivileged users from loading BPF programs until patches are deployed.
Restrict CAP_BPF and CAP_PERFMON capabilities to trusted service accounts only.

Patch Information

The fix disables preemption around get_perf_callchain and the subsequent trace entries buffer access in bpf_get_stackid. Upstream commits are available at Kernel Git Commit 15f1bd8, Kernel Git Commit c4efdc1d, and Kernel Git Commit ccf481d7. Consult your distribution vendor for backported kernel packages that include these commits.

Workarounds

Disable unprivileged BPF program loading system-wide via the kernel.unprivileged_bpf_disabled sysctl.
Remove or restrict access to perf event subsystems by tightening kernel.perf_event_paranoid to 3.
Use Linux Security Modules such as SELinux or AppArmor to deny the bpf syscall for non-administrative service accounts.

bash

# Configuration example
# Disable unprivileged BPF and tighten perf event access
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
sudo sysctl -w kernel.perf_event_paranoid=3

# Persist the settings across reboots
cat <<EOF | sudo tee /etc/sysctl.d/99-cve-2026-89799.conf
kernel.unprivileged_bpf_disabled=1
kernel.perf_event_paranoid=3
EOF
sudo sysctl --system