BPF Signature Size Limit Bypass in Linux Kernel

Publication date: 2026-05-27

Last updated on: 2026-06-16

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Limit bpf program signature size Practical BPF signatures are significantly smaller than KMALLOC_MAX_CACHE_SIZE Allowing larger sizes opens the door for abuse by passing excessive size values and forcing the kernel into expensive allocation paths (via kmalloc_large or vmalloc).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-16

Generated

2026-07-06

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-45971

EUVD

EUVD-2026-32255

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 6.19.4 (exc)
linux	linux_kernel	From 6.18 (inc) to 6.18.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel relates to the BPF (Berkeley Packet Filter) program signature size. The kernel previously allowed BPF program signatures to be larger than practical sizes, exceeding KMALLOC_MAX_CACHE_SIZE. This could be exploited by passing excessively large size values, which forces the kernel to use more expensive memory allocation methods such as kmalloc_large or vmalloc.

Impact Analysis

The impact of this vulnerability is that an attacker could abuse the kernel by forcing it into expensive memory allocation paths. This could potentially lead to performance degradation or resource exhaustion in the system, affecting stability and responsiveness.

Hi! I’m here to help you understand CVE-2026-45971. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70