CVE-2026-99129

What it actually does

The vulnerability is a TOCTOU race condition in SELinux BPF token permission checks, where the creator SID is looked up multiple times via file descriptor instead of using the resolved path or token itself in selinux_bpf_token_create, selinux_bpf_map_create, and selinux_bpf_prog_load, allowing inconsistent permission decisions.

Why it matters to the business

Systems relying on SELinux-enforced security policies for BPF operations face potential bypass of access controls, which could result in unauthorized execution of privileged kernel features on Linux hosts.

How an attack unfolds

An attacker with the ability to pass file descriptors manipulates timing between SID lookups to cause the kernel to use stale or attacker-controlled creator information during BPF token, map, or program creation.

How to fix it

Update the Linux kernel to a version containing the fix that eliminates redundant SID lookups via file descriptors and relies solely on resolved path or token data.

How to confirm the fix worked

Confirm the kernel source contains the updated selinux_bpf_token_create, selinux_bpf_map_create, and selinux_bpf_prog_load functions that perform a single SID lookup from the resolved dentry or token; test BPF token operations under SELinux enforcing mode.

Typical attack path

1. Gain local access on a SELinux-enabled Linux system that uses BPF
2. Prepare a BPF token file descriptor and trigger concurrent modifications
3. Invoke BPF creation syscalls to hit the window between SID lookups
4. Obtain permissions inconsistent with the actual token or path state

How to detect it

Examine kernel audit logs and SELinux AVC denials around BPF token, map, and program creation events for unexpected permission grants or repeated SID resolution attempts.

What your security team should do

• Prioritize kernel updates on all SELinux-enabled systems within standard change windows
• Review and tighten SELinux policies around BPF token and map operations
• Enable kernel audit logging for BPF-related syscalls to establish baseline behavior