Medium 5.5Published May 27, 2026

CVE-2026-45886bpf: Fix bpf_xdp_store_bytes proto for read-only arg

Updated under an hour ago (Oct 27, 2026, 9:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_xdp_store_bytes proto for read-only arg While making some maps in Cilium read-only from the BPF side, we noticed that the bpf_xdp_store_bytes proto is incorrect. In particular, the verifier was throwing the following error: ; ret = ctx_store_bytes(ctx, l3_off + offsetof(struct iphdr, saddr), &nat->address, 4, 0); 635: (79) r1 = *(u64 *)(r10 -144) ; R1=ctx() R10=fp0 fp-144=ctx() 636: (b4) w2 = 26 ; R2=26 637: (b4) w4 = 4 ; R4=4 638: (b4) w5 = 0 ; R5=0 639: (85) call bpf_xdp_store_bytes#190 write into map forbidden, value_size=6 off=0 size=4 nat comes from a BPF_F_RDONLY_PROG map, so R3 is a PTR_TO_MAP_VALUE. The verifier checks the helper's memory access to R3 in check_mem_size_reg, as it reaches ARG_CONST_SIZE argument. The third argument has expected type ARG_PTR_TO_UNINIT_MEM, which includes the MEM_WRITE flag. The verifier thus checks for a BPF_WRITE access on R3. Given R3 points to a read-only map, the check fails. Conversely, ARG_PTR_TO_UNINIT_MEM can also lead to the helper reading from uninitialized memory. This patch simply fixes the expected argument type to match that of bpf_skb_store_bytes.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 27, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 3f364222d032eea6b245780e845ad213dab28cdd before ffb5d1c5e3933b947fc7303ad68bf0c536d0c85e; from 3f364222d032eea6b245780e845ad213dab28cdd before ddc34a1b85505c919026ddc82fafdada9a160b15; 3f364222d032eea6b245780e845ad213dab28cdd builds before 0db169a91381a473b7974021d1c02f8da72c5775; from 3f364222d032eea6b245780e845ad213dab28cdd before d7b87adeb0eb539b9b824b101bb14fb01e41240b; from 3f364222d032eea6b245780e845ad213dab28cdd before 57f7f6a0ad04a65c8a7a067b2f56cbbf2aec9e52; from 3f364222d032eea6b245780e845ad213dab28cdd before 6557f1565d779851c4db9c488c49c05a47a6e72f	CNA record
linux linux_kernel linux:linux_kernel	from 5.18 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.14; from 6.19 before 6.19.4	NVD

References

References

https://git.kernel.org/stable/c/ffb5d1c5e3933b947fc7303ad68bf0c536d0c85e	patch
https://git.kernel.org/stable/c/ddc34a1b85505c919026ddc82fafdada9a160b15	patch
https://git.kernel.org/stable/c/0db169a91381a473b7974021d1c02f8da72c5775	patch
https://git.kernel.org/stable/c/d7b87adeb0eb539b9b824b101bb14fb01e41240b	patch
https://git.kernel.org/stable/c/57f7f6a0ad04a65c8a7a067b2f56cbbf2aec9e52	patch
https://git.kernel.org/stable/c/6557f1565d779851c4db9c488c49c05a47a6e72f	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.