CVE-2026-64354

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) component. This vulnerability, located in the btf_repeat_fields() function, is caused by an integer overflow when processing user-supplied BPF Type Format (BTF) data. A local attacker could exploit this flaw by providing a specially crafted BTF, leading to a heap out-of-bounds write. This could result in privilege escalation, allowing the attacker to gain elevated access to the system.

The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.