CVE-2026-45886

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix bpf_xdp_store_bytes proto for read-only arg

While making some maps in Cilium read-only from the BPF side, we noticed

that the bpf_xdp_store_bytes proto is incorrect. In particular, the

verifier was throwing the following error:

; ret = ctx_store_bytes(ctx, l3_off + offsetof(struct iphdr, saddr),

&nat->address, 4, 0);

635: (79) r1 = *(u64 *)(r10 -144) ; R1=ctx() R10=fp0 fp-144=ctx()

636: (b4) w2 = 26 ; R2=26

637: (b4) w4 = 4 ; R4=4

638: (b4) w5 = 0 ; R5=0

639: (85) call bpf_xdp_store_bytes#190

write into map forbidden, value_size=6 off=0 size=4

nat comes from a BPF_F_RDONLY_PROG map, so R3 is a PTR_TO_MAP_VALUE.

The verifier checks the helper's memory access to R3 in

check_mem_size_reg, as it reaches ARG_CONST_SIZE argument. The third

argument has expected type ARG_PTR_TO_UNINIT_MEM, which includes the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References