CVE-2026-45927 Details

A vulnerability in the Linux kernel's handling of BPF map hash calculations has been addressed. The issue arose because the function bpf_map_get_info_by_fd calculated and cached the hash of BPF maps without considering whether the map was frozen. This created a time-of-check-to-time-of-use (TOCTOU) vulnerability, allowing userspace to cache a hash, modify the map, and then freeze it, potentially misleading a trusted loader into using an outdated hash while loading altered content. The vulnerability affects the Linux kernel stable tree.

The vulnerability has been fixed in the Linux kernel by modifying the bpf_map_get_info_by_fd function to check if the map is frozen before calculating and caching the hash. If the map is not frozen, the function returns an error, preventing the use of a stale hash.