CVE-2026-80675

A flaw was found in libbpf, a library for working with eBPF (extended Berkeley Packet Filter) programs in the Linux kernel. This vulnerability occurs when the signed loader fails to ensure that metadata maps are exclusive during verification. A hostile host could exploit this by omitting exclusivity, allowing another BPF program to modify map contents after verification, leading to the loader validating stale data. This could result in a security bypass, where integrity checks are circumvented.

A flaw of moderate severity was found in the libbpf signed loader in the Linux kernel. The loader verifies the SHA hash of a frozen metadata map, calculated when BPF_OBJ_GET_INFO_BY_FD is called on the map, against the metadata hash embedded in the loader's instructions, but it did not require the metadata map to be exclusive. A hostile host that omits map exclusivity when loading the loader can let another BPF program with access to the map modify its contents after the hash has been calculated, so the integrity check succeeds on stale data and the signed loader's verification can be bypassed. Exploitation requires local access to and control over the BPF loading environment, which is why Red Hat rates this flaw moderate (CVSS 5.5, local attack vector) while the upstream CVEORG rating is important (7.1). Red Hat Enterprise Linux 6, 7, 8, and 9, as well as RHEL 10.0.z and RHEL 10.2.z, are not affected because the vulnerable code is not present. The kernel in RHEL 10.3 and RHEL 10.4 and the kernel components in Red Hat In-Vehicle OS 2 streams are affected, with the fix currently deferred to a future release. The residual risk of the deferral is a local integrity bypass of the BPF signed loader's verification, which requires a hostile host or a local attacker with BPF program loading and map access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.