CVE-2026-93045 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject arena frees below the arena base
bpf_arena_free_pages() accepts scalar arena addresses. The runtime masks the address to the low 32 bits and reconstructs a full user address from the arena base before returning the range to the arena free tree.
When the scalar value is below the low 32 bits of the arena base, full_uaddr falls below user_vm_start. The existing upper-end clipping then turns this into an out-of-range free-tree offset. A later allocation can reuse that offset and return an address below the arena mapping.
Reject such frees before computing the clipped range.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel's BPF subsystem contains a critical logic flaw within the bpf_arena_free_pages function, which is responsible for managing memory deallocation in eBPF arenas. This vulnerability arises from an insufficient validation of scalar arena addresses prior to their processing by the runtime address masking mechanism. Specifically, when a user-space program requests the freeing of pages using a BPF helper or instruction that provides a scalar value representing an arena address, the kernel masks this input to its lower 32 bits and attempts to reconstruct a full virtual memory address based on the known base of the allocated arena region. The flaw occurs because the implementation fails to verify whether the original scalar value is greater than or equal to the low thirty-two-bit portion of the arena's base address before performing these arithmetic operations.
When the provided scalar address falls below the lower boundary defined by the arena base, the subsequent reconstruction logic results in a full user virtual memory address that resides below the valid start of the user-space mapping for that arena. This out-of-bounds condition is not immediately caught because the existing code applies an upper-end clipping mechanism to ensure addresses do not exceed the end of the allocated region. However, this clipping operation incorrectly handles underflow conditions by wrapping or clamping the address into a negative offset relative to the free tree's internal indexing structure. Consequently, instead of rejecting the invalid deallocation request, the kernel treats it as a valid memory range and inserts an entry into the arena's free list at an incorrect, potentially negative index position.
The operational impact of this vulnerability is severe due to its potential for exploitation leading to arbitrary code execution or system instability. A malicious user-space process can deliberately craft BPF programs that trigger these invalid frees with carefully chosen scalar values below the arena base threshold. By doing so, they manipulate the internal state of the memory allocator's free tree. Subsequent allocation requests from either legitimate kernel components or other processes may then reuse this corrupted offset, resulting in the return of a virtual address that lies outside the intended bounds of the BPF arena mapping. This effectively allows an attacker to gain access to arbitrary kernel memory regions or corrupt heap structures by writing data through these improperly allocated pointers, bypassing standard isolation boundaries enforced by the eBPF verifier and sandbox mechanisms.
From a vulnerability classification perspective, this issue aligns with CWE-190 Integer Overflow or Wraparound, as the arithmetic operations on addresses lead to unexpected values due to insufficient boundary checks before masking. It also relates closely to CWE-787 Out-of-bounds Write if the returned address is used for memory writes, and potentially CWE-416 Use After Free if the corrupted free list entries cause double-free scenarios or use-after-free conditions during subsequent allocations. In terms of attack vectors, this falls under ATT&CK technique T1059 Command and Scripting Interpreter via eBPF programs, where an attacker leverages BPF capabilities to manipulate kernel memory structures for privilege escalation or lateral movement within the host environment.
To mitigate this vulnerability, it is imperative that system administrators apply the latest available Linux kernel patches that include the fix described in the advisory. The patch explicitly adds a check to reject any free operations where the scalar address is below the low thirty-two bits of the arena base before proceeding with range clipping and insertion into the free tree. For environments running older, unsupported kernels without immediate access to updates, restricting unprivileged users from loading eBPF programs or utilizing BPF helpers that interact directly with memory arenas can serve as a temporary compensating control. Additionally, enabling strict kernel hardening options such as CONFIG_BPF_JIT_ALWAYS_ON and ensuring proper seccomp filters are in place can help limit the attack surface by preventing unauthorized execution of potentially malicious BPF bytecode within untrusted contexts.