PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45886 Linux CVE debrief

A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem has been resolved. The issue was an incorrect function prototype for `bpf_xdp_store_bytes` that used `ARG_PTR_TO_UNINIT_MEM` for its third argument, which incorrectly included the `MEM_WRITE` flag. This caused the BPF verifier to reject legitimate programs attempting to use `bpf_xdp_store_bytes` with read-only map values, as the verifier would check for `BPF_WRITE` access on read-only map pointers and fail. Additionally, `ARG_PTR_TO_UNINIT_MEM` could allow reading from uninitialized memory. The fix aligns the argument type with `bpf_skb_store_bytes` to use the correct memory access semantics.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running XDP-based networking solutions, particularly Cilium users leveraging read-only BPF maps, and Linux kernel maintainers responsible for BPF subsystem stability.

Technical summary

The bpf_xdp_store_bytes helper function in the Linux kernel had an incorrect prototype that specified ARG_PTR_TO_UNINIT_MEM for its source data argument. This type includes MEM_WRITE semantics, causing the BPF verifier to incorrectly reject programs passing read-only map values to this helper. The verifier's check_mem_size_reg function would detect the BPF_WRITE flag and fail when R3 pointed to a BPF_F_RDONLY_PROG map. The fix changes the expected argument type to match bpf_skb_store_bytes, resolving both the false rejection of legitimate programs and the potential for reading uninitialized memory.

Defensive priority

medium

Recommended defensive actions

  • Review BPF programs using bpf_xdp_store_bytes to ensure they function correctly after kernel updates
  • Apply kernel updates containing the referenced stable commits when available for your distribution
  • Monitor for any BPF program loading failures after kernel upgrades that may indicate verifier behavior changes
  • Consider testing XDP programs with read-only map configurations to verify correct operation

Evidence notes

The vulnerability description indicates this was discovered during Cilium development when making maps read-only from the BPF side. The verifier error 'write into map forbidden' demonstrates the incorrect access check. Multiple stable kernel commits are referenced, indicating backports to various kernel versions.

Official resources

2026-05-27