CVE-2026-80675

Received Received - Intake

Linux Kernel BPF Metadata Map Validation Bypass

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: libbpf: Reject non-exclusive metadata maps in the signed loader The loader verifies map->sha against the metadata hash in its instructions. map->sha is calculated when BPF_OBJ_GET_INFO_BY_FD is called on the frozen map. While the map is frozen, the /signed loader/ must also ensure the map is exclusive, as, without exclusivity (which a hostile host could just omit when loading the loader), another BPF program with map access can mutate the contents afterwards, so the check passes on stale data. With the extra check as part of the signed loader, it now refuses to move on with map->sha validation if the host set it up wrongly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80675

EUVD

EUVD-2026-67551

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	libbpf	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the libbpf signed loader. The loader checks the integrity of BPF maps by comparing a hash (map->sha) against metadata. However, if the map is not exclusive, a hostile host could modify the map contents after the hash check, allowing the loader to validate stale data. The fix adds a check to ensure the map is exclusive before proceeding with hash validation.

Detection Guidance

This vulnerability is specific to the Linux kernel's libbpf component and requires checking for non-exclusive metadata maps in BPF programs. Detection involves inspecting BPF maps and loader behavior. No direct commands are provided in the context, but you should verify if your kernel version includes the fix and check BPF map configurations for exclusivity.

Impact Analysis

If exploited, this vulnerability could allow an attacker to bypass integrity checks in BPF programs, potentially leading to unauthorized code execution or privilege escalation. Systems relying on BPF for security or isolation may be compromised, enabling further attacks on the host or other workloads.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a specific technical issue in the Linux kernel's libbpf component. The flaw involves improper validation of metadata maps in signed BPF loaders, which could allow unauthorized modification of map contents. However, no evidence suggests this vulnerability impacts data protection, privacy, or security controls required by GDPR or HIPAA.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for this vulnerability. Since the issue is resolved in the kernel, applying the latest stable kernel update is the primary mitigation step. Monitor vendor advisories for specific kernel versions addressing this CVE.

Hi! I’m here to help you understand CVE-2026-80675. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70