CVE-2026-93045

What it actually does

The flaw in bpf_arena_free_pages() accepts scalar arena addresses below the arena base; after masking and reconstruction, the resulting full_uaddr falls below user_vm_start, the upper-end clipping produces an out-of-range free-tree offset, and subsequent allocations can return addresses below the arena mapping, enabling memory corruption.

Why it matters to the business

Local attackers on Linux systems can corrupt kernel memory structures, potentially leading to privilege escalation, system instability, or denial of service with moderate operational risk given low exploit maturity and prevalence.

How an attack unfolds

An attacker with local access loads a BPF program that invokes bpf_arena_free_pages using a crafted scalar value below the arena base; the kernel computes an invalid free-tree offset that can later be reused during allocation to return a mapping below the intended arena region for further corruption.

How to fix it

Apply the upstream kernel patch that adds an explicit check rejecting arena frees whose scalar value is below the low 32 bits of the arena base before any clipping or offset calculation occurs.

How to confirm the fix worked

Inspect the bpf_arena_free_pages implementation in the running kernel source or binary to confirm presence of the early rejection of addresses below the arena base; test with crafted BPF programs that previously triggered the out-of-range condition.

Typical attack path

1. Obtain local user access on a Linux host
2. Load a malicious BPF program via the bpf syscall
3. Invoke bpf_arena_free_pages with an address below the arena base
4. Trigger subsequent allocations that reuse the corrupted free-tree offset
5. Leverage the resulting out-of-range mapping for memory corruption

How to detect it

Review kernel audit logs and BPF event traces for invocations of arena free helpers with anomalous scalar values; correlate with subsequent unexpected allocation patterns or memory faults below arena mappings.

What your security team should do

• Prioritize kernel updates containing the arena-free rejection logic
• Restrict unprivileged BPF loading via sysctl or LSM policies
• Monitor kernel logs for unusual arena allocation or free patterns
• Audit custom BPF programs for direct use of arena free helpers