CVE-2026-64192 (GCVE-0-2026-64192)

Vulnerability from cvelistv5 – Published: 2026-07-20 16:27 – Updated: 2026-07-20 16:27
VLAI
Title
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized When CONFIG_BPF_LSM=y is set, BPF inode storage maps (BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However, if the BPF LSM is not explicitly enabled at boot time (e.g. omitted from the "lsm=" boot parameter), lsm_prepare() is never executed for the BPF LSM. Consequently, the BPF inode security blob offset (bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at its default compiled size of 8 bytes instead of being updated to a valid offset past the reserved struct rcu_head (typically 16 bytes or more). When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE map, bpf_inode() evaluates inode->i_security + 8. This erroneously aliases the struct rcu_head.func callback pointer at the beginning of the inode->i_security blob. During subsequent map element cleanup or inode destruction, writing NULL to owner_storage clears the queued RCU callback pointer. When rcu_do_batch() later executes the queued callback, it attempts an instruction fetch at address 0x0, triggering an immediate kernel panic. Fix this by introducing a global bpf_lsm_initialized boolean flag marked with __ro_after_init. Set this flag to true inside bpf_lsm_init() when the LSM framework successfully registers the BPF LSM. Gate map allocation in inode_storage_map_alloc() on this flag, returning -EOPNOTSUPP if the BPF LSM is in turn uninitialized. This fail-fast approach prevents userspace from allocating inode storage maps when the supporting BPF LSM infrastructure is absent, avoiding zombie map states.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8ea636848aca35b9f97c5b5dee30225cf2dd0fe6 , < c76b8abce575e0c6e4096957220b4515ed847d89 (git)
Affected: 8ea636848aca35b9f97c5b5dee30225cf2dd0fe6 , < a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4 (git)
Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc2 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf_lsm.h",
            "kernel/bpf/bpf_inode_storage.c",
            "security/bpf/hooks.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c76b8abce575e0c6e4096957220b4515ed847d89",
              "status": "affected",
              "version": "8ea636848aca35b9f97c5b5dee30225cf2dd0fe6",
              "versionType": "git"
            },
            {
              "lessThan": "a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4",
              "status": "affected",
              "version": "8ea636848aca35b9f97c5b5dee30225cf2dd0fe6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf_lsm.h",
            "kernel/bpf/bpf_inode_storage.c",
            "security/bpf/hooks.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized\n\nWhen CONFIG_BPF_LSM=y is set, BPF inode storage maps\n(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However,\nif the BPF LSM is not explicitly enabled at boot time (e.g. omitted\nfrom the \"lsm=\" boot parameter), lsm_prepare() is never executed for\nthe BPF LSM.\n\nConsequently, the BPF inode security blob offset\n(bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at\nits default compiled size of 8 bytes instead of being updated to a\nvalid offset past the reserved struct rcu_head (typically 16 bytes\nor more).\n\nWhen a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE\nmap, bpf_inode() evaluates inode-\u003ei_security + 8. This erroneously\naliases the struct rcu_head.func callback pointer at the beginning\nof the inode-\u003ei_security blob. During subsequent map element cleanup\nor inode destruction, writing NULL to owner_storage clears the queued\nRCU callback pointer. When rcu_do_batch() later executes the queued\ncallback, it attempts an instruction fetch at address 0x0, triggering\nan immediate kernel panic.\n\nFix this by introducing a global bpf_lsm_initialized boolean flag\nmarked with __ro_after_init. Set this flag to true inside bpf_lsm_init()\nwhen the LSM framework successfully registers the BPF LSM. Gate map\nallocation in inode_storage_map_alloc() on this flag, returning\n-EOPNOTSUPP if the BPF LSM is in turn uninitialized.\n\nThis fail-fast approach prevents userspace from allocating inode\nstorage maps when the supporting BPF LSM infrastructure is absent,\navoiding zombie map states."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-20T16:27:51.720Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c76b8abce575e0c6e4096957220b4515ed847d89"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4"
        }
      ],
      "title": "bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64192",
    "datePublished": "2026-07-20T16:27:51.720Z",
    "dateReserved": "2026-07-19T07:54:57.040Z",
    "dateUpdated": "2026-07-20T16:27:51.720Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64192",
      "date": "2026-07-22",
      "epss": "0.00145",
      "percentile": "0.04244"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-22T01:01:38.000Z",
      "cve": "CVE-2026-64192",
      "id": "msrc_CVE-2026-64192",
      "initial_release_date": "2026-07-22T01:01:38.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64192.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64192\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-20T17:18:22.367\",\"lastModified\":\"2026-07-20T17:18:22.367\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized\\n\\nWhen CONFIG_BPF_LSM=y is set, BPF inode storage maps\\n(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However,\\nif the BPF LSM is not explicitly enabled at boot time (e.g. omitted\\nfrom the \\\"lsm=\\\" boot parameter), lsm_prepare() is never executed for\\nthe BPF LSM.\\n\\nConsequently, the BPF inode security blob offset\\n(bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at\\nits default compiled size of 8 bytes instead of being updated to a\\nvalid offset past the reserved struct rcu_head (typically 16 bytes\\nor more).\\n\\nWhen a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE\\nmap, bpf_inode() evaluates inode-\u003ei_security + 8. This erroneously\\naliases the struct rcu_head.func callback pointer at the beginning\\nof the inode-\u003ei_security blob. During subsequent map element cleanup\\nor inode destruction, writing NULL to owner_storage clears the queued\\nRCU callback pointer. When rcu_do_batch() later executes the queued\\ncallback, it attempts an instruction fetch at address 0x0, triggering\\nan immediate kernel panic.\\n\\nFix this by introducing a global bpf_lsm_initialized boolean flag\\nmarked with __ro_after_init. Set this flag to true inside bpf_lsm_init()\\nwhen the LSM framework successfully registers the BPF LSM. Gate map\\nallocation in inode_storage_map_alloc() on this flag, returning\\n-EOPNOTSUPP if the BPF LSM is in turn uninitialized.\\n\\nThis fail-fast approach prevents userspace from allocating inode\\nstorage maps when the supporting BPF LSM infrastructure is absent,\\navoiding zombie map states.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/bpf_lsm.h\",\"kernel/bpf/bpf_inode_storage.c\",\"security/bpf/hooks.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8ea636848aca35b9f97c5b5dee30225cf2dd0fe6\",\"lessThan\":\"c76b8abce575e0c6e4096957220b4515ed847d89\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8ea636848aca35b9f97c5b5dee30225cf2dd0fe6\",\"lessThan\":\"a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/bpf_lsm.h\",\"kernel/bpf/bpf_inode_storage.c\",\"security/bpf/hooks.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c76b8abce575e0c6e4096957220b4515ed847d89\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-21T10:21:01+00:00",
      "cve": "CVE-2026-64192",
      "id": "CVE-2026-64192",
      "initial_release_date": "2026-07-20T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64192.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-07-21T12:58:01Z",
      "cve": "CVE-2026-64192",
      "id": "CVE-2026-64192",
      "initial_release_date": "2026-07-21T12:58:01Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64192",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64192.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.