CVE-2026-89579

Received Received - Intake

Heap Overflow in Linux Kernel BPF Subsystem

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloom_map_alloc() has two 32-bit-specific problems when the computed bitmap reaches the U32_MAX fallback case. First, BITS_TO_BYTES(U32_MAX) is evaluated with 32-bit arithmetic. The addition performed by DIV_ROUND_UP wraps, so the map allocates only the fixed-size bloom filter object while keeping bitset_mask == U32_MAX. Subsequent updates can then write past the allocated object. Second, fixing only the allocation size is not sufficient. The bloom hash is a u32, but set_bit() takes a signed long bit number and x86 test_bit() eventually feeds the index to variable_test_bit(long, ...). On 32-bit kernels, hashes in [0x80000000, U32_MAX] therefore become negative bit offsets. x86 bt/bts with a memory operand interpret those offsets relative to the supplied base, so a map with bitset_mask == U32_MAX can read or write before bloom->bitset even after allocating the full 512 MiB bitmap. Keep the U32_MAX fallback, but split each hash into a word pointer and an in-word bit number before calling test_bit() or set_bit(). The bitops argument is then always in [0, BITS_PER_LONG - 1], while BIT_WORD(h) still selects the intended word in the full bitmap. Compute the bitset size from (u64)bitset_mask + 1 before passing the final size to bpf_map_area_alloc(). This fixes the original under-allocation and keeps the allocated storage consistent with the addressable bitset. Exploitation note: local privilege escalation is possible on a 32-bit x86 kernel using the under-allocation bug from a binary with CAP_BPF.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89579

EUVD

EUVD-2026-76491

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the Linux kernel's BPF (Berkeley Packet Filter) bloom filter implementation on 32-bit systems. It involves two issues: under-allocation of memory when the bitmap size reaches the maximum 32-bit value, and incorrect handling of hash values that become negative bit offsets on 32-bit x86 kernels. This can lead to out-of-bounds memory access during bloom filter operations.

Detection Guidance

This vulnerability affects the Linux kernel's BPF implementation on 32-bit systems. Detection requires checking kernel version and BPF-related configurations. Use 'uname -a' to verify if your system runs a 32-bit kernel. Inspect BPF-related modules with 'lsmod | grep bpf'. Monitor kernel logs for unusual BPF-related errors or crashes.

Impact Analysis

On a 32-bit x86 Linux system with CAP_BPF privileges, this vulnerability could allow local privilege escalation. An attacker could exploit the memory corruption to gain elevated system access, potentially compromising the entire system.

Mitigation Strategies

Upgrade the Linux kernel to a patched version that resolves this issue. If using a 32-bit x86 kernel, consider migrating to a 64-bit kernel if possible. Remove or restrict CAP_BPF capabilities from untrusted binaries. Apply vendor-supplied security patches immediately.

Hi! I’m here to help you understand CVE-2026-89579. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70