SB20260528177 - Improper access control in Linux kernel core

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-45903)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause incorrect program behavior.

The vulnerability exists due to improper access control in BPF helper prototypes when the verifier performs memory access optimizations across helper calls. A local user can invoke helper functions with incorrectly specified memory access flags to cause incorrect program behavior.

The issue stems from the verifier incorrectly assuming that buffer contents remain unchanged after certain helper calls.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/802eef5afb1865bc5536a5302c068ba2215a1f72
• https://git.kernel.org/stable/c/aa319592892068bd960c1a1c07bd621085b0c63d
• https://git.kernel.org/stable/c/fdfe75161f6e8c41a7d3023fbb815b537107b806