CVE-2026-45971 Linux CVE debrief

Who should care

Linux system administrators, kernel maintainers, security teams operating eBPF-based observability or security tooling, and organizations with custom BPF program loading workflows

Technical summary

The Linux kernel's BPF subsystem did not enforce practical limits on BPF program signature sizes. Attackers could supply excessive size values to force the kernel into expensive allocation paths (kmalloc_large or vmalloc), potentially causing resource exhaustion or performance degradation. The resolution limits signature sizes to values significantly smaller than KMALLOC_MAX_CACHE_SIZE, aligning with practical signature dimensions and preventing abuse of large allocation mechanisms.

Defensive priority

medium

Recommended defensive actions

• Apply kernel updates from stable branches when available
• Monitor for BPF-related resource exhaustion anomalies
• Review BPF program loading permissions and audit signature sizes in use

Evidence notes

CVE published 2026-05-27. Kernel commit references indicate stable branch fixes. No CVSS score assigned by NVD at time of disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.