CVE-2026-80675

CVE CVE-2026-80675EUVD EUVD-2026-67551Published 2026-08-28T06:49:14.000ZLast changed 2026-08-29T06:22:02.000ZCVSS 7.1

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: libbpf: Reject non-exclusive metadata maps in the signed loader The loader verifies map->sha against the metadata hash in its instructions. map->sha is calculated when BPF_OBJ_GET_INFO_BY_FD is called on the frozen map. While the map is frozen, the /signed loader/ must also ensure the map is exclusive, as, without exclusivity (which a hostile host could just omit when loading the loader), another BPF program with map access can mutate the contents afterwards, so the check passes on stale data. With the extra check as part of the signed loader, it now refuses to move on with map->sha validation if the host set it up wrongly.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux fb2b0e290147ba01a53dfd92cf91058c9d2ee254 <b6862b6a25c6a925fb0b0e549ee4a52a8d2966fb; fb2b0e290147ba01a53dfd92cf91058c9d2ee254 <0fb6c9ed6493b4af01be8bb0a384574eba7df636; patch: 6.18.40; patch: 0; 6.18; fb2b0e290147ba01a53dfd92cf91058c9d2ee254 <0dad5adeb34b6f78a883e8faa6a1c947a240e7c9; patch: 7.1.5; patch: 7.2

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.