A high-severity vulnerability in the Linux kernel BPF subsystem could allow an attacker with low privileges to bypass security guarantees and mutate exclusive maps.

The vulnerability exists within the BPF subsystem, where the kernel fails to properly reject exclusive maps when used as inner maps within a map-of-maps structure. This bypasses the intended exclusivity guarantee, allowing an authenticated, low-privileged user to potentially mutate maps that should be bound to a single program.

Successful exploitation of this flaw could lead to unauthorized data modification or the defeat of security controls, such as those implemented by the signed loader. Given the CVSS score of 7.1, this represents a significant risk to system integrity. While the attack requires local access and low privileges, it could be leveraged by a malicious actor to escalate their influence over kernel operations or manipulate sensitive security metadata.

Immediate Action: Update the Linux kernel to version 6.18.40, 7.1.5, or a later stable release as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for unusual BPF program loading activity or unexpected errors related to map-in-map operations.

Compensating Controls: Restrict the ability to load eBPF programs to trusted users through system configuration and access control policies until the kernel can be patched.

Public Exploit Available: No

This vulnerability presents a clear risk to the integrity of the Linux kernel BPF subsystem. System administrators should prioritize testing and deploying the provided kernel patches to the affected versions. Applying the update to 6.18.40 or 7.1.5 is the only definitive way to restore the exclusivity guarantees intended for BPF maps.