PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45886 Linux CVE debrief

A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem has been resolved. The issue was an incorrect function prototype for `bpf_xdp_store_bytes` that used `ARG_PTR_TO_UNINIT_MEM` for its third argument, which incorrectly included the `MEM_WRITE` flag. This caused the BPF verifier to reject legitimate programs attempting to use `bpf_xdp_store_bytes` with read-only map values, as the verifier would check for `BPF_WRITE` access on read-only map pointers and fail. Additionally, `ARG_PTR_TO_UNINIT_MEM` could allow reading from uninitialized memory. The fix aligns the argument type with `bpf_skb_store_bytes` to use the correct memory access semantics.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Organizations running XDP-based networking solutions, particularly Cilium users leveraging read-only BPF maps, and Linux kernel maintainers responsible for BPF subsystem stability.

Technical summary

The bpf_xdp_store_bytes helper function in the Linux kernel had an incorrect prototype that specified ARG_PTR_TO_UNINIT_MEM for its source data argument. This type includes MEM_WRITE semantics, causing the BPF verifier to incorrectly reject programs passing read-only map values to this helper. The verifier's check_mem_size_reg function would detect the BPF_WRITE flag and fail when R3 pointed to a BPF_F_RDONLY_PROG map. The fix changes the expected argument type to match bpf_skb_store_bytes, resolving both the false rejection of legitimate programs and the potential for reading uninitialized memory.

Defensive priority

medium

Recommended defensive actions

  • Review BPF programs using bpf_xdp_store_bytes to ensure they function correctly after kernel updates
  • Apply kernel updates containing the referenced stable commits when available for your distribution
  • Monitor for any BPF program loading failures after kernel upgrades that may indicate verifier behavior changes
  • Consider testing XDP programs with read-only map configurations to verify correct operation

Evidence notes

The vulnerability description indicates this was discovered during Cilium development when making maps read-only from the BPF side. The verifier error 'write into map forbidden' demonstrates the incorrect access check. Multiple stable kernel commits are referenced, indicating backports to various kernel versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45886 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45886

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45886 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45886

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0db169a91381a473b7974021d1c02f8da72c5775

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/57f7f6a0ad04a65c8a7a067b2f56cbbf2aec9e52

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6557f1565d779851c4db9c488c49c05a47a6e72f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d7b87adeb0eb539b9b824b101bb14fb01e41240b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ddc34a1b85505c919026ddc82fafdada9a160b15

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ffb5d1c5e3933b947fc7303ad68bf0c536d0c85e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.