CVE-2026-99129: selinux: fix BPF token permission checks
In the Linux kernel, the following vulnerability has been resolved:
selinux: fix BPF token permission checks
Avoid multiple lookups of the bpffs creator SID using the token's file descriptor when the same information can be found via the resolved path/dentry (in selinuxbpftokencreate()) or the token itself (in selinuxbpfmapcreate() and selinuxbpfprogload()). Not only does this simplify the code, it avoids potential TOCTOU issues if the user changes the token file descriptor passed into the kernel.
Event History
Frequently Asked Questions
What condition is required for exploitation?
An attacker would need to be able to change the BPF token file descriptor passed to the kernel during the relevant permission-checking flow, creating a time-of-check/time-of-use race.
Which operations are involved in the affected permission checks?
The issue involves SELinux BPF token handling during token creation, BPF map creation, and BPF program loading.
What is the practical remediation?
Apply the kernel fix referenced in the stable kernel commits. The fix obtains the creator SID from the resolved path/dentry or token itself rather than performing repeated lookups through a user-controlled token file descriptor.