UBUNTU-CVE-2026-99129: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: selinux: fix BPF token permission checks Avoid multiple lookups of the bpffs creator SID using the token's file descriptor when the same information can be found via the resolved path/dentry (in selinuxbpftokencreate()) or the token itself (in selinuxbpfmapcreate() and selinuxbpfprogload()). Not only does this simplify the code, it avoids potential TOCTOU issues if the user changes the token file descriptor passed into the kernel.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to exploit this issue?
An attacker would need to be able to invoke the affected SELinux BPF token operations and change the token file descriptor while the kernel is performing permission checks. The flaw is a time-of-check/time-of-use race involving lookups of the bpffs creator SID.
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What is the practical mitigation if an update cannot be applied immediately?
Limit untrusted users' ability to use BPF token operations and prevent them from changing token file descriptors during those operations. This reduces exposure to the race in SELinux permission checking.