CVE-2026-80675

A flaw of moderate severity was found in the libbpf signed loader in the Linux kernel. The loader verifies the SHA hash of a frozen metadata map, calculated when BPF_OBJ_GET_INFO_BY_FD is called on the map, against the metadata hash embedded in the loader's instructions, but it did not require the metadata map to be exclusive. A hostile host that omits map exclusivity when loading the loader can let another BPF program with access to the map modify its contents after the hash has been calculated, so the integrity check succeeds on stale data and the signed loader's verification can be bypassed. Exploitation requires local access to and control over the BPF loading environment, which is why Red Hat rates this flaw moderate (CVSS 5.5, local attack vector) while the upstream CVEORG rating is important (7.1). Red Hat Enterprise Linux 6, 7, 8, and 9, as well as RHEL 10.0.z and RHEL 10.2.z, are not affected because the vulnerable code is not present. The kernel in RHEL 10.3 and RHEL 10.4 and the kernel components in Red Hat In-Vehicle OS 2 streams are affected, with the fix currently deferred to a future release. The residual risk of the deferral is a local integrity bypass of the BPF signed loader's verification, which requires a hostile host or a local attacker with BPF program loading and map access.