BLOG
At a glance
- ZDI-26-1005 is an eBPF race condition in the Linux Kernel.
- A local attacker must already be able to execute code with high privileges; successful exploitation could enable privilege escalation and arbitrary code execution in the kernel context.
- Check the running kernel, compare it with the distributor-integrated fix, and update according to the Linux fix.
Linux Kernel: eBPF race condition could enable local privilege escalation
ZDI-26-1005 is an eBPF race condition in the Linux Kernel that could let a local user with high privileges escalate privileges and execute arbitrary code in the kernel context. Check the running kernel, compare it with the distributor-integrated fix, and update according to the Linux fix.
In this article
Zero Day Initiative published advisory ZDI-26-1005 about a Linux Kernel eBPF flaw. The advisory describes the exploitation requirement, how to check the running kernel, and the linked fix in the ZDI-26-1005 advisory.
Overview and technical details
The flaw is a race condition in callback pointer handling caused by the lack of appropriate locking when operating on an object. ZDI-26-1005 is associated with ZDI-CAN-31417; the provided CVSS score is 7.5.
| Field | Details |
|---|---|
| Product | Linux Kernel |
| Advisory ID | ZDI-26-1005 |
| ZDI ID | ZDI-CAN-31417 |
| CVSS | 7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) |
Affected systems
The source record does not identify affected Linux Kernel branches or a specific fixed version. Therefore, a safe version threshold cannot be determined from the kernel version number alone; check the patch information provided by the Linux distributor.
Mechanism and impact
A local attacker must already be able to execute code with high privileges before exploiting the flaw. Successful exploitation could enable privilege escalation and arbitrary code execution in the kernel context.
System checks
- Check the running kernel version, then compare it with patch information from the Linux distributor. This command alone cannot determine whether the fix is integrated without distributor information.
uname -r
Remediation and mitigation
- Update the Linux Kernel according to the fix released by Linux. Before scheduling deployment, identify the kernel build in which the distributor has integrated the fix.
The fix is linked in Linux commit 1e28a5e52d32b7d3f4c9fb24898774f941166d2b.
Related articles
Ubuntu Linux kernel for NVIDIA Tegra: check systems and apply security updates
Ubuntu USN-9091-1 warns of multiple vulnerabilities in the Linux kernel for NVIDIA Tegra. The supplied record gives no affected branches or fixed packages. Check installed kernels and packages, then consult the Ubuntu notice for the applicable update.
Linux Kernel CVE-2026-99284: Local Privilege Escalation to Root and the Required Fix
Zero Day Initiative warns of CVE-2026-99284 in Linux Kernel: a low-privileged user able to execute code locally could escalate to root. Identify running kernel versions and update to a Linux release containing the fix.
Linux Kernel: BPF Local Storage race condition may enable privilege escalation
ZDI-26-1007 describes a race condition in Linux Kernel BPF Local Storage. A local attacker needs high-privileged code execution; successful exploitation may enable privilege escalation and arbitrary code execution in the kernel context. Check the kernel version and apply the vendor update.
