Linux Kernel up to 6.18.13/6.19.3 bpf_map_get_info_by_fd toctou

Summaryinfo

A vulnerability classified as critical has been found in Linux Kernel up to 6.18.13/6.19.3. This impacts the function bpf_map_get_info_by_fd. The manipulation leads to toctou. This vulnerability is referenced as CVE-2026-45927. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.18.13/6.19.3. It has been rated as critical. This issue affects the function bpf_map_get_info_by_fd. The manipulation with an unknown input leads to a toctou vulnerability. Using CWE to declare the problem leads to CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: bpf: Require frozen map for calculating map hash Currently, bpf_map_get_info_by_fd calculates and caches the hash of the map regardless of the map's frozen state. This leads to a TOCTOU bug where userspace can call BPF_OBJ_GET_INFO_BY_FD to cache the hash and then modify the map contents before freezing. Therefore, a trusted loader can be tricked into verifying the stale hash while loading the modified contents. Fix this by returning -EPERM if the map is not frozen when the hash is requested. This ensures the hash is only generated for the final, immutable state of the map.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2026-45927 since 05/13/2026. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 6.18.14 or 6.19.4 eliminates this vulnerability. Applying the patch 7752d36343862323bbeea4ce3adf0ec2ed86e122/f415e114b58fe02c41191e47f24bdabb438daf72/a2c86aa621c22f2a7e26c654f936d65cfff0aa91 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.19.0
• 6.19.1
• 6.19.2
• 6.19.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion