SB20260912200 - Out-of-bounds write in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-89579)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to escalate privileges.

The vulnerability exists due to out-of-bounds memory access in the BPF bloom filter bitset allocation and indexing logic when processing BPF bloom filter map operations on 32-bit kernels. A local privileged user can create a bloom filter map with a maximal bitset and perform updates to escalate privileges.

Exploitation is possible on 32-bit x86 kernels from a binary with CAP_BPF.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/11c1e836710dcba03e50454a4eedfdbaf8d3050e
• https://git.kernel.org/stable/c/272fcb4ba6fab678db0eb966dc81c4c804bef64a
• https://git.kernel.org/stable/c/3b7a13eccfcf97714ffc1ca6aa663d66d4a30e29
• https://git.kernel.org/stable/c/dff481e12b3f127739f6a4ea7cef2c25dc12e056