CVE-2026-64192

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

When CONFIG_BPF_LSM=y is set, BPF inode storage maps

(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However,

if the BPF LSM is not explicitly enabled at boot time (e.g. omitted

from the "lsm=" boot parameter), lsm_prepare() is never executed for

the BPF LSM.

Consequently, the BPF inode security blob offset

(bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at

its default compiled size of 8 bytes instead of being updated to a

valid offset past the reserved struct rcu_head (typically 16 bytes

or more).

When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE

map, bpf_inode() evaluates inode->i_security + 8. This erroneously

aliases the struct rcu_head.func callback pointer at the beginning

of the inode->i_security blob. During subsequent map element cleanup

or inode destruction, writing NULL to owner_st

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References