{"api_version":"1","generated_at":"2026-08-29T12:12:57+00:00","cve":"CVE-2026-80675","urls":{"html":"https://cve.report/CVE-2026-80675","api":"https://cve.report/api/cve/CVE-2026-80675.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-80675","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-80675"},"summary":{"title":"libbpf: Reject non-exclusive metadata maps in the signed loader","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibbpf: Reject non-exclusive metadata maps in the signed loader\n\nThe loader verifies map->sha against the metadata hash in its\ninstructions. map->sha is calculated when BPF_OBJ_GET_INFO_BY_FD is\ncalled on the frozen map.\n\nWhile the map is frozen, the /signed loader/ must also ensure the map\nis exclusive, as, without exclusivity (which a hostile host could just\nomit when loading the loader), another BPF program with map access can\nmutate the contents afterwards, so the check passes on stale data.\n\nWith the extra check as part of the signed loader, it now refuses to\nmove on with map->sha validation if the host set it up wrongly.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-28 08:16:52","updated_at":"2026-08-29 07:16:49"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","data":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/0dad5adeb34b6f78a883e8faa6a1c947a240e7c9","name":"https://git.kernel.org/stable/c/0dad5adeb34b6f78a883e8faa6a1c947a240e7c9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/0fb6c9ed6493b4af01be8bb0a384574eba7df636","name":"https://git.kernel.org/stable/c/0fb6c9ed6493b4af01be8bb0a384574eba7df636","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b6862b6a25c6a925fb0b0e549ee4a52a8d2966fb","name":"https://git.kernel.org/stable/c/b6862b6a25c6a925fb0b0e549ee4a52a8d2966fb","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80675","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80675","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fb2b0e290147ba01a53dfd92cf91058c9d2ee254 b6862b6a25c6a925fb0b0e549ee4a52a8d2966fb git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fb2b0e290147ba01a53dfd92cf91058c9d2ee254 0dad5adeb34b6f78a883e8faa6a1c947a240e7c9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fb2b0e290147ba01a53dfd92cf91058c9d2ee254 0fb6c9ed6493b4af01be8bb0a384574eba7df636 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.18","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.40 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"80675","cve":"CVE-2026-80675","epss":"0.001660000","percentile":"0.060720000","score_date":"2026-08-28","updated_at":"2026-08-29 00:12:17"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/bpf.h","kernel/bpf/syscall.c","tools/lib/bpf/gen_loader.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b6862b6a25c6a925fb0b0e549ee4a52a8d2966fb","status":"affected","version":"fb2b0e290147ba01a53dfd92cf91058c9d2ee254","versionType":"git"},{"lessThan":"0dad5adeb34b6f78a883e8faa6a1c947a240e7c9","status":"affected","version":"fb2b0e290147ba01a53dfd92cf91058c9d2ee254","versionType":"git"},{"lessThan":"0fb6c9ed6493b4af01be8bb0a384574eba7df636","status":"affected","version":"fb2b0e290147ba01a53dfd92cf91058c9d2ee254","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/bpf.h","kernel/bpf/syscall.c","tools/lib/bpf/gen_loader.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.40","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"6.18","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibbpf: Reject non-exclusive metadata maps in the signed loader\n\nThe loader verifies map->sha against the metadata hash in its\ninstructions. map->sha is calculated when BPF_OBJ_GET_INFO_BY_FD is\ncalled on the frozen map.\n\nWhile the map is frozen, the /signed loader/ must also ensure the map\nis exclusive, as, without exclusivity (which a hostile host could just\nomit when loading the loader), another BPF program with map access can\nmutate the contents afterwards, so the check passes on stale data.\n\nWith the extra check as part of the signed loader, it now refuses to\nmove on with map->sha validation if the host set it up wrongly."}],"metrics":[{"cvssV3_1":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is reached only through bpf(2) syscalls (BPF_MAP_CREATE, BPF_MAP_FREEZE, BPF_OBJ_GET_INFO_BY_FD, BPF_PROG_LOAD, BPF_PROG_RUN) and BPF map helpers on the metadata map; per kernel guidance BPF is a local attack vector.\nAC:L - Exploitation is a reliable attacker-controlled sequence: omit excl_prog_hash, freeze and hash benign metadata, mutate the map via a colluding BPF program, then run the signed loader with no races or uncontrollable layout dependencies.\nPR:L - Triggering the signed-loader path requires local BPF privileges (CAP_BPF for map/program operations); per kernel guidance this is Low because CAP_BPF can be obtained by unprivileged users via user namespaces and BPF tokens, not only init-namespace root.\nUI:N - No victim interaction is required; a hostile host or local attacker with BPF access can omit map exclusivity, tamper metadata between hash computation and loader execution, and bypass verification without actions by other users.\nS:U - The impact is bypass of BPF signed-loader metadata integrity controls within the kernel BPF subsystem, enabling load of attacker-controlled programs; this is standard kernel security-boundary impact, not VM escape or IOMMU bypass.\nC:H - Bypassing metadata verification lets a tampered signed loader instantiate arbitrary BPF programs that can use kernel helpers such as bpf_probe_read_kernel for arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - Without the exclusivity check, cached map->sha can remain valid while another BPF program rewrites frozen metadata, letting the loader execute a tampered blob and load unsigned or attacker-chosen BPF with kernel write and code-execution potential.\nA:N - This is an authentication and integrity bypass without memory corruption, use-after-free, or kernel panic; exploitation does not inherently cause crashes, hangs, or denial of kernel availability."}]}],"providerMetadata":{"dateUpdated":"2026-08-29T06:22:02.823Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/b6862b6a25c6a925fb0b0e549ee4a52a8d2966fb"},{"url":"https://git.kernel.org/stable/c/0dad5adeb34b6f78a883e8faa6a1c947a240e7c9"},{"url":"https://git.kernel.org/stable/c/0fb6c9ed6493b4af01be8bb0a384574eba7df636"}],"title":"libbpf: Reject non-exclusive metadata maps in the signed loader","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-80675","datePublished":"2026-08-28T06:49:14.148Z","dateReserved":"2026-08-26T14:34:25.783Z","dateUpdated":"2026-08-29T06:22:02.823Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-28 08:16:52","lastModifiedDate":"2026-08-29 07:16:49","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"80675","Ordinal":"1","Title":"libbpf: Reject non-exclusive metadata maps in the signed loader","CVE":"CVE-2026-80675","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"80675","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibbpf: Reject non-exclusive metadata maps in the signed loader\n\nThe loader verifies map->sha against the metadata hash in its\ninstructions. map->sha is calculated when BPF_OBJ_GET_INFO_BY_FD is\ncalled on the frozen map.\n\nWhile the map is frozen, the /signed loader/ must also ensure the map\nis exclusive, as, without exclusivity (which a hostile host could just\nomit when loading the loader), another BPF program with map access can\nmutate the contents afterwards, so the check passes on stale data.\n\nWith the extra check as part of the signed loader, it now refuses to\nmove on with map->sha validation if the host set it up wrongly.","Type":"Description","Title":"libbpf: Reject non-exclusive metadata maps in the signed loader"}]}}}