CVE-2026-45951 (GCVE-0-2026-45951)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:18 – Updated: 2026-08-05 12:28
VLAI
Title
bpf: Fix a potential use-after-free of BTF object
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a potential use-after-free of BTF object Refcounting in the check_pseudo_btf_id() function is incorrect: the __check_pseudo_btf_id() function might get called with a zero refcounted btf. Fix this, and patch related code accordingly. v3: rephrase a comment (AI) v2: fix a refcount leak introduced in v1 (AI)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 76145f7255326761dafb76721a785799d8a00d5f , < eac65c272f3b49021a843cba5107d63627395e0e (git)
Affected: 76145f7255326761dafb76721a785799d8a00d5f , < 9ff46ffeecdb1802d6e26183177935b948a12e7f (git)
Affected: 76145f7255326761dafb76721a785799d8a00d5f , < ccd2d799ed4467c07f5ee18c2f5c59bcc990822c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.14 , ≤ 6.18.* (semver)
Unaffected: 6.19.4 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eac65c272f3b49021a843cba5107d63627395e0e",
              "status": "affected",
              "version": "76145f7255326761dafb76721a785799d8a00d5f",
              "versionType": "git"
            },
            {
              "lessThan": "9ff46ffeecdb1802d6e26183177935b948a12e7f",
              "status": "affected",
              "version": "76145f7255326761dafb76721a785799d8a00d5f",
              "versionType": "git"
            },
            {
              "lessThan": "ccd2d799ed4467c07f5ee18c2f5c59bcc990822c",
              "status": "affected",
              "version": "76145f7255326761dafb76721a785799d8a00d5f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a potential use-after-free of BTF object\n\nRefcounting in the check_pseudo_btf_id() function is incorrect:\nthe __check_pseudo_btf_id() function might get called with a zero\nrefcounted btf. Fix this, and patch related code accordingly.\n\nv3: rephrase a comment (AI)\nv2: fix a refcount leak introduced in v1 (AI)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the local bpf() syscall (BPF_PROG_LOAD verifying a BPF_PSEUDO_BTF_ID ldimm64 instruction); there is no network, adjacent, or physical input path.\nAC:L - Triggering the UAF requires racing a concurrent close of the BTF fd against the verifier, but the attacker controls both sides (loading thread and closing thread) and can retry/heap-spray indefinitely, so per kernel guidance an attacker-created race is Low.\nPR:L - Obtaining a BTF fd (BPF_BTF_LOAD) and loading the program both require CAP_BPF, which can be delegated to a non-init user namespace via BPF token/bpffs in reasonable container deployments, making this reachable to a non-host-root local user.\nUI:N - The attacker performs the entire attack themselves by issuing bpf() syscalls and closing the fd; no victim action is required.\nS:U - The use-after-free and its consequences are confined to the kernel\u0027s own memory and security authority; no boundary such as VM or IOMMU is crossed.\nC:H - The freed BTF object is dereferenced (type/name/kallsyms lookups) and can be reallocated with attacker-controlled data, giving a kernel-memory read primitive characteristic of a use-after-free.\nI:H - The UAF causes a refcount increment on freed memory and stores a dangling btf pointer into env-\u003eused_btfs[] that is used later, enabling heap grooming and type confusion that can be leveraged into a write/control-flow primitive.\nA:H - Dereferencing the freed BTF object reliably crashes the kernel (oops/panic), so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:53.157Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eac65c272f3b49021a843cba5107d63627395e0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ff46ffeecdb1802d6e26183177935b948a12e7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ccd2d799ed4467c07f5ee18c2f5c59bcc990822c"
        }
      ],
      "title": "bpf: Fix a potential use-after-free of BTF object",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45951",
    "datePublished": "2026-05-27T12:18:07.255Z",
    "dateReserved": "2026-05-13T15:03:33.088Z",
    "dateUpdated": "2026-08-05T12:28:53.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45951",
      "date": "2026-09-30",
      "epss": "0.00168",
      "percentile": "0.0553"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "eac65c272f3b49021a843cba5107d63627395e0e",
                    "status": "affected",
                    "version": "76145f7255326761dafb76721a785799d8a00d5f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9ff46ffeecdb1802d6e26183177935b948a12e7f",
                    "status": "affected",
                    "version": "76145f7255326761dafb76721a785799d8a00d5f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ccd2d799ed4467c07f5ee18c2f5c59bcc990822c",
                    "status": "affected",
                    "version": "76145f7255326761dafb76721a785799d8a00d5f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C969BF0A-760D-435A-9705-6ED20216C1BB",
                    "versionEndExcluding": "6.18.14",
                    "versionStartIncluding": "6.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "672A3E79-EC03-479D-8503-361DFBDC8092",
                    "versionEndExcluding": "6.19.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a potential use-after-free of BTF object\n\nRefcounting in the check_pseudo_btf_id() function is incorrect:\nthe __check_pseudo_btf_id() function might get called with a zero\nrefcounted btf. Fix this, and patch related code accordingly.\n\nv3: rephrase a comment (AI)\nv2: fix a refcount leak introduced in v1 (AI)"
          }
        ],
        "id": "CVE-2026-45951",
        "lastModified": "2026-06-17T10:52:47.033",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-05-27T14:17:11.613",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9ff46ffeecdb1802d6e26183177935b948a12e7f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ccd2d799ed4467c07f5ee18c2f5c59bcc990822c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/eac65c272f3b49021a843cba5107d63627395e0e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:50:46+00:00",
      "cve": "CVE-2026-45951",
      "id": "CVE-2026-45951",
      "initial_release_date": "2026-05-27T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Fix a potential use-after-free of BTF object",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45951.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-27T16:59:07Z",
      "cve": "CVE-2026-45951",
      "id": "CVE-2026-45951",
      "initial_release_date": "2026-05-28T03:55:34Z",
      "product_status:known_not_affected": "299",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-45951",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-45951.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.