Improper access control in Linux kernel - CVE-2026-45903
Published: May 28, 2026
Vulnerability identifier: #VU132589
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-45903
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause incorrect program behavior.
The vulnerability exists due to improper access control in BPF helper prototypes when the verifier performs memory access optimizations across helper calls. A local user can invoke helper functions with incorrectly specified memory access flags to cause incorrect program behavior.
The issue stems from the verifier incorrectly assuming that buffer contents remain unchanged after certain helper calls.
How to mitigate CVE-2026-45903
Install security update from vendor's repository.