The Linux kernel vulnerability CVE-2026-45886 concerns the bpf_xdp_store_bytes helper function used in BPF programs. When using read-only maps (BPF_F_RDONLY_PROG), the verifier incorrectly expected a writable memory argument, causing it to reject valid operations or potentially misinterpret memory access permissions. The root cause was the argument type for the third parameter of bpf_xdp_store_bytes being set incorrectly as ARG_PTR_TO_UNINIT_MEM requiring write access, whereas it should match the type used by bpf_skb_store_bytes. This fix corrects the expected argument type to properly handle read-only map pointers, resolving verifier errors and preventing potential denial of service due to verifier rejection.

This vulnerability does not allow disclosure or modification of data (no confidentiality or integrity impact). However, it can cause denial of service by preventing legitimate BPF programs from loading or running correctly due to verifier errors when accessing read-only maps. The CVSS vector indicates local attack vector with low complexity and privileges required, no user interaction, and an impact limited to availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch or vendor advisory is provided, users should monitor official Linux kernel releases and security advisories for updates addressing CVE-2026-45886. Until a fix is applied, avoid deploying BPF programs that rely on bpf_xdp_store_bytes with read-only maps if possible.