SB20260528150 - Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-45927)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass integrity verification.

The vulnerability exists due to a time-of-check time-of-use race condition in bpf_map_get_info_by_fd when calculating and caching the map hash before the map is frozen. A local user can modify map contents after the hash is cached to bypass integrity verification.

Exploitation requires a trusted loader to verify the cached hash while loading the modified map contents.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/7752d36343862323bbeea4ce3adf0ec2ed86e122
• https://git.kernel.org/stable/c/a2c86aa621c22f2a7e26c654f936d65cfff0aa91
• https://git.kernel.org/stable/c/f415e114b58fe02c41191e47f24bdabb438daf72