VulnerabilityPublished 27 May 2026Updated 6 Nov 2026

CVE-2026-45886: Linux kernel · bpf: Fix bpf_xdp_store_bytes proto for read-only arg

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ffb5d1c5e3933b947fc7303ad68bf0c536d0c85e : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:06 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in ffb5d1c5e3933b947fc7303ad68bf0c536d0c85e, ddc34a1b85505c919026ddc82fafdada9a160b15, d7b87adeb0eb539b9b824b101bb14fb01e41240b +3

Exploitation evidence

Disclosed: evidence found.
CVE published 27 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 3f364222d032eea6b245780e845ad213dab28cdd, < ffb5d1c5e3933b947fc7303ad68bf0c536d0c85e	Fixed in ffb5d1c5e3933b947fc7303ad68bf0c536d0c85e
LinuxLinux	Affected ≥ 3f364222d032eea6b245780e845ad213dab28cdd, < ddc34a1b85505c919026ddc82fafdada9a160b15	Fixed in ddc34a1b85505c919026ddc82fafdada9a160b15
LinuxLinux	Affected ≥ 3f364222d032eea6b245780e845ad213dab28cdd, < d7b87adeb0eb539b9b824b101bb14fb01e41240b	Fixed in d7b87adeb0eb539b9b824b101bb14fb01e41240b
LinuxLinux	Affected ≥ 3f364222d032eea6b245780e845ad213dab28cdd, < 6557f1565d779851c4db9c488c49c05a47a6e72f	Fixed in 6557f1565d779851c4db9c488c49c05a47a6e72f
LinuxLinux	Affected ≥ 3f364222d032eea6b245780e845ad213dab28cdd, < 57f7f6a0ad04a65c8a7a067b2f56cbbf2aec9e52	Fixed in 57f7f6a0ad04a65c8a7a067b2f56cbbf2aec9e52
LinuxLinux	Affected ≥ 3f364222d032eea6b245780e845ad213dab28cdd, < 0db169a91381a473b7974021d1c02f8da72c5775	Fixed in 0db169a91381a473b7974021d1c02f8da72c5775

AI-suggested

A fix for this vulnerability is available and has been applied in specific Linux kernel commits. Users and administrators should update their Linux kernel to a fixed version containing these patches to resolve the issue. No additional mitigation is required beyond applying the official fix.

Description

CVE-2026-45886 is a vulnerability in the Linux kernel related to the bpf_xdp_store_bytes helper function. The issue arises because the function's prototype incorrectly expects a writable argument when it should accept a read-only argument. This causes the BPF verifier to reject certain legitimate read-only map operations, leading to errors when using read-only BPF maps such as those in Cilium. The vulnerability has been fixed by correcting the argument type to match that of a similar helper function, bpf_skb_store_bytes.

Impact

This vulnerability causes the BPF verifier in the Linux kernel to incorrectly reject eBPF programs that use read-only maps with the bpf_xdp_store_bytes helper. This can prevent legitimate BPF programs from loading or functioning correctly, potentially impacting applications relying on read-only BPF maps such as Cilium. There is no indication of direct security compromise or exploitation in the wild.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 16:06 UTC

Technical details

References

Community reviews

Related threats