CVE-2026-99129 in Linux
Summary
by MITRE • 10/28/2026
In the Linux kernel, the following vulnerability has been resolved:
selinux: fix BPF token permission checks
Avoid multiple lookups of the bpffs creator SID using the token's file descriptor when the same information can be found via the resolved path/dentry (in selinux_bpf_token_create()) or the token itself (in selinux_bpf_map_create() and selinux_bpf_prog_load()). Not only does this simplify the code, it avoids potential TOCTOU issues if the user changes the token file descriptor passed into the kernel.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The Linux Security Modules framework includes SELinux as a mandatory access control system that enforces security policies on processes and objects within the operating system. A specific vulnerability was identified in the handling of BPF tokens, which are used to manage permissions for eBPF programs and maps without requiring full root privileges. The core issue lies in how permission checks were performed during the creation of these resources. Specifically, the code previously relied on multiple lookups of the creator Security Identifier using the token's file descriptor passed by user space. This approach introduced a race condition window where an attacker could modify or swap the underlying file descriptor between the initial check and its actual use, leading to a Time-of-Check-to-Time-of-Use vulnerability.
This flaw allows for potential privilege escalation if an unprivileged user can manipulate the file descriptor associated with the BPF token during the kernel's permission verification process. By resolving the Security Identifier through the resolved path or dentry in selinux_bpf_token_create, and directly from the token structure itself in selinux_bpf_map_create and selinux_bpf_prog_load, the code eliminates the dependency on a mutable file descriptor for critical security decisions. This change ensures that the identity of the creator is determined at a stable point in time, effectively closing the race condition window. The fix not only enhances security but also simplifies the kernel code by removing redundant lookups and reducing complexity.
From an industry standards perspective, this vulnerability aligns with CWE-367, which describes Time-of-check to Time-of-use (TOCTOU) race conditions. These are particularly dangerous in systems programming where concurrent access or manipulation of shared resources can lead to inconsistent states that bypass security controls. In the context of the MITRE ATT&CK framework, this type of vulnerability could be leveraged for Privilege Escalation via a TOCTOU race condition, allowing an attacker to gain higher-level permissions than intended by the system's security policy. The mitigation addresses these risks by ensuring atomicity and consistency in how creator identities are validated during BPF resource creation.
The operational impact of this vulnerability is significant because it affects the integrity of mandatory access control policies for eBPF applications, which are increasingly used for networking, observability, and tracing tasks. If exploited, an attacker could potentially load malicious programs or create maps with elevated privileges, compromising system stability and security. The resolution ensures that SELinux policy enforcement remains robust against such manipulation attempts. System administrators should apply the relevant kernel updates to mitigate this risk. Additionally, developers working on BPF-related applications should ensure their code adheres to best practices for handling file descriptors securely, avoiding reliance on mutable references during critical permission checks.