All vulnerabilities
CVE-2026-99129

selinux: fix BPF token permission checks

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in77d499e61d36e883a6ad1f10afe05f556aa7e0ccFixed versionCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 77d499e61d36e883a6ad1f10afe05f556aa7e0ccLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

selinux: fix BPF token permission checks

Avoid multiple lookups of the bpffs creator SID using the token's file descriptor when the same information can be found via the resolved path/dentry (in selinux_bpf_token_create()) or the token itself (in selinux_bpf_map_create() and selinux_bpf_prog_load()). Not only does this simplify the code, it avoids potential TOCTOU issues if the user changes the token file descriptor passed into the kernel.

Text from CVE List

Affected versions 6

  • Linuxaffected: 5473a722f782f79f96b4691400d681c01fcacc2f before e1ef306ba20eb13099ca4463527890df67619405CVE List
  • Linuxaffected: 5473a722f782f79f96b4691400d681c01fcacc2f before 77d499e61d36e883a6ad1f10afe05f556aa7e0ccCVE List
  • Linuxaffected: 7.0CVE List
  • Linuxunaffected: all versions before 7.0CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2