Description
The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly maintain an fd data structure, which allows local users to gain privileges or cause a denial of service (use-after-free) via crafted BPF instructions that reference an incorrect file descriptor.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 4.5.3-1 | — |
| Debian 13 | linux | 4.5.3-1 | — |
| Debian 12 | linux | 4.5.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux | 4.4.0-22.39 | USN-2965-1 |
| Ubuntu 16.04 LTS | linux-raspi2 | 4.4.0-1010.12 | USN-2965-3 |
| Ubuntu 16.04 LTS | linux-snapdragon | 4.4.0-1013.14 | USN-2965-4 |
| Ubuntu 14.04 LTS | linux-lts-xenial | 4.4.0-22.39~14.04.1 | USN-2965-2 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 4.8.13-1.1 | openSUSE-SU-2024:10128-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Linux BPF doubleput UAF Privilege Escalation
exploit/linux/local/bpf_priv_esc
Exploit-DB 2
- Linux Kernel 4.4 (Ubuntu 16.04) - 'BPF' Local Privilege Escalation (Metasploit) EDB-40759 · local · Nov 14, 2016 · verified
- Linux Kernel 4.4.x (Ubuntu 16.04) - 'double-fdput()' bpf(BPF_PROG_LOAD) Privilege Escalation EDB-39772 · local · May 4, 2016 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- USN-2965-1 linux vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-2965-2 linux-lts-xenial vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-2965-3 linux-raspi2 vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-2965-4 linux-snapdragon vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:10128-1 kernel-debug-4.8.13-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://bugs.debian.org/823603
- openSUSE-SU-2016:1641 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1334307
- https://github.com/torvalds/linux/commit/8358b02bf67d3a5d8a825070e1aa73f25fb2e4c7
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.5
- https://bugs.chromium.org/p/project-zero/issues/detail?id=808
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8358b02bf67d3a5d8a825070e1aa73f25fb2e4c7
- [oss-security] 20160506 CVE Requests: Linux: BPF flaws (one use-after-free / local root privilege escalation) mailing-list
- 40759 exploit