Cloudanix VulnDB

CVE-2026-89579

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel on 32-bit computers lets certain local users break out of their normal limits and take over the whole machine.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Privilege Gain
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Under-allocation of bloom filter bitmap and negative bit offsets during set_bit/test_bit operations on 32-bit kernels allow out-of-bounds read/write past the allocated map object when bitset_mask reaches U32_MAX.

Why it matters to the business

Attackers on 32-bit Linux systems who can load BPF programs can corrupt kernel memory and gain full system control, risking data theft or ransomware on unpatched endpoints.

How an attack unfolds

An attacker with CAP_BPF creates a bloom filter map sized to trigger the U32_MAX fallback, causing the kernel to allocate insufficient storage while allowing bit operations to reference memory before the bitset; repeated map updates then achieve arbitrary kernel read/write for local privilege escalation on 32-bit x86.

How to fix it

Upgrade to a kernel containing the bloom filter sizing and indexing hardening; rebuild and deploy 32-bit kernels with the corrected (u64) arithmetic and split hash-to-word conversion before calling bitops.

How to confirm the fix worked

Confirm the running kernel version includes the bloom_map_alloc changes; on 32-bit test systems exercise bloom filter maps near U32_MAX size and verify no oops or memory corruption occurs.

Typical attack path

  1. Obtain CAP_BPF or equivalent rights to load BPF maps
  2. Allocate a bloom filter map sized to hit the U32_MAX allocation path
  3. Perform repeated updates that exercise out-of-bounds bit operations
  4. Corrupt adjacent kernel structures to disable protections
  5. Execute payload to gain root privileges

How to detect it

Review kernel logs for BPF-related oops or warnings mentioning bloom maps; correlate with audit records of BPF program loads by non-root users.

What your security team should do

  • Apply the kernel fix to all 32-bit deployments within the next maintenance window
  • Restrict CAP_BPF to only administrative or audited processes
  • Audit BPF map creation events from unprivileged users

The record

In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloom_map_alloc() has two 32-bit-specific problems when the computed bitmap reaches the U32_MAX fallback case. First, BITS_TO_BYTES(U32_MAX) is evaluated with 32-bit arithmetic. The addition performed by DIV_ROUND_UP wraps, so the map allocates only the fixed-size bloom filter object while keeping bitset_mask == U32_MAX. Subsequent updates can then write past the allocated object. Second, fixing only the allocation size is not sufficient. The bloom hash is a u32, but set_bit() takes a signed long bit number and x86 test_bit() eventually feeds the index to variable_test_bit(long, ...). On 32-bit kernels, hashes in [0x80000000, U32_MAX] therefore become negative bit offsets. x86 bt/bts with a memory operand interpret those offsets relative to the supplied base, so a map with bitset_mask == U32_MAX can read or write before bloom->bitset even after allocating the full 512 MiB bitmap. Keep the U32_MAX fallback, but split each hash into a word pointer and an in-word bit number before calling test_bit() or set_bit(). The bitops argument is then always in [0, BITS_PER_LONG - 1], while BIT_WORD(h) still selects the intended word in the full bitmap. Compute the bitset size from (u64)bitset_mask + 1 before passing the final size to bpf_map_area_alloc(). This fixes the original under-allocation and keeps the allocated storage consistent with the addressable bitset. Exploitation note: local privilege escalation is possible on a 32-bit x86 kernel using the under-allocation bug from a binary with CAP_BPF.

Affected packages

Ecosystem Package Introduced Fixed