From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D669F3F0A8E for ; Wed, 27 May 2026 12:24:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779884646; cv=none; b=sUYTXI/Z476rwSV5+7eYMu3DV3hr3GfHHl/FmIUQUQwVsOoFGEwvhShhQm4h28iBFbGS8/A8dNmFKBIs+CbKUYd0Bb+587ZYCeIflLIcA0c6dGdRAoIgzWeUi5vrwhEfPUn2XaN3hOxbhFjhyo25m2MNHt0f1Lws6vwsYbgKfJY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779884646; c=relaxed/simple; bh=XJgF9fraS30EfRG5myI8Ef57AJkuEMT0SNN2y68q8HU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=p7rM+oNvkJPfIxM+/qmThrZsysuimwkXLE9jTjQkl/rMDmtSzEpXI+ALsUeYlOOXw+CkEpk/N19mYdIVyx+Qg8keAygDBfYboUG9F8PftNIZ2hgceFp6N68VkGN2Utgv1hid+h9IwiI7Ki3P94Ok++Vk4VWoDz0gMKfCYL9lUa8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=oDTL0Lrc; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="oDTL0Lrc" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 386381F000E9; Wed, 27 May 2026 12:24:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1779884644; bh=t33LGFunkemeVS9XtU3DZ8xerB6UbJo1EFDen3/oUlo=; h=From:To:Cc:Subject:Date:Reply-To; b=oDTL0LrcKec7G/jYl54P9yvSDjXHEcUSmC4Wb2OYAPd6wr8WvC5tD+hsMUXPDPeFu x1F3neesQNZDEVi7uCJWZ+SluIMZk6yH0uhJTw1csQf/qlfufMVPMcqvTCRZNrQMbv 87tlMJzOcSRwYtHW3hcq/VEPg+7HTuINTDyjB0ec= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-45927: bpf: Require frozen map for calculating map hash Date: Wed, 27 May 2026 14:19:29 +0200 Message-ID: <2026052726-CVE-2026-45927-e864@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2526; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=/zPl3VcKEYG06t7vT8n29Mfb/t2B/h5D4fepA9FAwHU=; b=owGbwMvMwCRo6H6F97bub03G02pJDFliD4WK78+44s8177XdWre37VIJdhNX7gyJnvy0Jt/J2 F2/cfvtjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZiIkzfD/KKPRtGPJP5Wv3vw pHGD1/lf98+93cAwV65uhQFnp16f64W8HO6oD+2ffjFlAAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: bpf: Require frozen map for calculating map hash Currently, bpf_map_get_info_by_fd calculates and caches the hash of the map regardless of the map's frozen state. This leads to a TOCTOU bug where userspace can call BPF_OBJ_GET_INFO_BY_FD to cache the hash and then modify the map contents before freezing. Therefore, a trusted loader can be tricked into verifying the stale hash while loading the modified contents. Fix this by returning -EPERM if the map is not frozen when the hash is requested. This ensures the hash is only generated for the final, immutable state of the map. The Linux kernel CVE team has assigned CVE-2026-45927 to this issue. Affected and fixed versions =========================== Issue introduced in 6.18 with commit ea2e6467ac36bf3d785defc89e58269b15d182f7 and fixed in 6.18.14 with commit 7752d36343862323bbeea4ce3adf0ec2ed86e122 Issue introduced in 6.18 with commit ea2e6467ac36bf3d785defc89e58269b15d182f7 and fixed in 6.19.4 with commit f415e114b58fe02c41191e47f24bdabb438daf72 Issue introduced in 6.18 with commit ea2e6467ac36bf3d785defc89e58269b15d182f7 and fixed in 7.0 with commit a2c86aa621c22f2a7e26c654f936d65cfff0aa91 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-45927 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: kernel/bpf/syscall.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/7752d36343862323bbeea4ce3adf0ec2ed86e122 https://git.kernel.org/stable/c/f415e114b58fe02c41191e47f24bdabb438daf72 https://git.kernel.org/stable/c/a2c86aa621c22f2a7e26c654f936d65cfff0aa91