CVE-2026-64508

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) Just-In-Time (JIT) compiler. The BPF JIT allocator reuses memory space, and when new code is written, an indirect jump into the new program can reuse a branch prediction left behind by an old program. This could allow an attacker to bypass security hardening mechanisms, potentially leading to information disclosure or other impacts. The vulnerability is mitigated by flushing indirect branch predictors before reusing JIT memory.

The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.

For the Red Hat Enterprise Linux to confirm the current state, inspect the sysctl with the command:

cat /proc/sys/kernel/unprivileged_bpf_disabled

The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue on systems where unprivileged BPF is enabled, configure the kernel to disallow unprivileged users from loading BPF programs.

1. Temporarily apply the configuration at runtime:

sysctl -w kernel.unprivileged_bpf_disabled=1

2. To make this setting persistent across system reboots, write the parameter to a sysctl configuration file:

echo "kernel.unprivileged_bpf_disabled = 1" > /etc/sysctl.d/99-disable-unprivileged-bpf.conf

sysctl --system

Caveats: Disabling unprivileged BPF prevents unprivileged user processes and unprivileged containers from loading BPF programs, which may impact non-root monitoring or tracing tools. Privileged accounts and processes retaining CAP_SYS_ADMIN or CAP_BPF are unaffected and can still load programs. Modifying this sysctl setting takes effect immediately and does not require a system restart or service reload.