{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80675","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-26T14:34:25.783Z","datePublished":"2026-08-28T06:49:14.148Z","dateUpdated":"2026-08-29T06:22:02.823Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-29T06:22:02.823Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibbpf: Reject non-exclusive metadata maps in the signed loader\n\nThe loader verifies map->sha against the metadata hash in its\ninstructions. map->sha is calculated when BPF_OBJ_GET_INFO_BY_FD is\ncalled on the frozen map.\n\nWhile the map is frozen, the /signed loader/ must also ensure the map\nis exclusive, as, without exclusivity (which a hostile host could just\nomit when loading the loader), another BPF program with map access can\nmutate the contents afterwards, so the check passes on stale data.\n\nWith the extra check as part of the signed loader, it now refuses to\nmove on with map->sha validation if the host set it up wrongly."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is reached only through bpf(2) syscalls (BPF_MAP_CREATE, BPF_MAP_FREEZE, BPF_OBJ_GET_INFO_BY_FD, BPF_PROG_LOAD, BPF_PROG_RUN) and BPF map helpers on the metadata map; per kernel guidance BPF is a local attack vector.\nAC:L - Exploitation is a reliable attacker-controlled sequence: omit excl_prog_hash, freeze and hash benign metadata, mutate the map via a colluding BPF program, then run the signed loader with no races or uncontrollable layout dependencies.\nPR:L - Triggering the signed-loader path requires local BPF privileges (CAP_BPF for map/program operations); per kernel guidance this is Low because CAP_BPF can be obtained by unprivileged users via user namespaces and BPF tokens, not only init-namespace root.\nUI:N - No victim interaction is required; a hostile host or local attacker with BPF access can omit map exclusivity, tamper metadata between hash computation and loader execution, and bypass verification without actions by other users.\nS:U - The impact is bypass of BPF signed-loader metadata integrity controls within the kernel BPF subsystem, enabling load of attacker-controlled programs; this is standard kernel security-boundary impact, not VM escape or IOMMU bypass.\nC:H - Bypassing metadata verification lets a tampered signed loader instantiate arbitrary BPF programs that can use kernel helpers such as bpf_probe_read_kernel for arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - Without the exclusivity check, cached map->sha can remain valid while another BPF program rewrites frozen metadata, letting the loader execute a tampered blob and load unsigned or attacker-chosen BPF with kernel write and code-execution potential.\nA:N - This is an authentication and integrity bypass without memory corruption, use-after-free, or kernel panic; exploitation does not inherently cause crashes, hangs, or denial of kernel availability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/bpf.h","kernel/bpf/syscall.c","tools/lib/bpf/gen_loader.c"],"versions":[{"version":"fb2b0e290147ba01a53dfd92cf91058c9d2ee254","lessThan":"b6862b6a25c6a925fb0b0e549ee4a52a8d2966fb","status":"affected","versionType":"git"},{"version":"fb2b0e290147ba01a53dfd92cf91058c9d2ee254","lessThan":"0dad5adeb34b6f78a883e8faa6a1c947a240e7c9","status":"affected","versionType":"git"},{"version":"fb2b0e290147ba01a53dfd92cf91058c9d2ee254","lessThan":"0fb6c9ed6493b4af01be8bb0a384574eba7df636","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/bpf.h","kernel/bpf/syscall.c","tools/lib/bpf/gen_loader.c"],"versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/b6862b6a25c6a925fb0b0e549ee4a52a8d2966fb"},{"url":"https://git.kernel.org/stable/c/0dad5adeb34b6f78a883e8faa6a1c947a240e7c9"},{"url":"https://git.kernel.org/stable/c/0fb6c9ed6493b4af01be8bb0a384574eba7df636"}],"title":"libbpf: Reject non-exclusive metadata maps in the signed loader","x_generator":{"engine":"bippy-1.2.0"}}}}