CVE-2026-93045

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The attacker-controlled input is the scalar ptr passed to bpf_arena_free_pages() from a locally loaded BPF program after bpf(BPF_MAP_CREATE) of BPF_MAP_TYPE_ARENA, mmap() of that map, bpf(BPF_PROG_LOAD), and bpf(BPF_PROG_TEST_RUN) (e.g. BPF_PROG_TYPE_SYSCALL). The below-base address is not carried in a network protocol message.

AC:LAttack complexity, low

The attacker chooses the scalar whose low 32 bits are below (u32)arena->user_vm_start and the page_cnt passed to bpf_arena_free_pages(); compute_pgoff() then underflows and range_tree_set() records that offset deterministically. No race, victim state, or rare non-default config is required on JITs that implement bpf_jit_supports_arena() (x86_64/arm64).

PR:LPrivileges required, low

map_create() requires bpf_token_capable(CAP_BPF) for BPF_MAP_TYPE_ARENA, and check_map_prog_compatibility() additionally requires CAP_PERFMON (env->allow_ptr_leaks) before a program may reference the arena. Those caps are delegable through BPF tokens into a user namespace rather than requiring init-namespace root.

UI:NUser interaction, none

The attacker creates their own arena map, mmap()s it so user_vm_start is set, loads their own program that calls bpf_arena_free_pages() with a below-base scalar, and runs it via BPF_PROG_TEST_RUN. No separate victim mount, open, or other interaction is required.

S:UScope, unchanged

arena_free_pages() corrupts the arena range_tree and kernel PTEs of the same host kernel that loaded the program. This is in-kernel memory unsafety, not a KVM/Xen guest-to-host escape or IOMMU/DMA boundary cross.

C:HConfidentiality impact, high

With a below-base scalar and a large page_cnt, arena_free_pages() clips uaddr_end to user_vm_end so apply_to_existing_page_range() walks from kern_vm_start+uaddr32 across in-use arena PTEs and __free_page()s those pages while compute_pgoff() records a wrapped offset, leaving a page UAF that can disclose kernel memory.

I:HIntegrity impact, high

The same clipped free desynchronizes PTEs from the range_tree, and zap_pages() calls zap_vma_range() with full_uaddr below vma->vm_start, clearing mm PTEs outside the arena VMA. A later bpf_arena_alloc_pages() reuses the out-of-range offset via range_tree_find(), giving an exploitable page-reuse write primitive.

A:HAvailability impact, high

Accessing a below-base pointer with a negative LDX/STX off faults below kern_vm_start, where bpf_arena_handle_page_fault() refuses recovery and oopses; zap_vma_range() also VM_WARN_ON_ONCE()s for a range outside the arena VMA, and the UAF of freed arena pages can panic the kernel.