Description
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs, which can result in a type confusion condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-14689.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Kernel | 5.14-rc3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 5.14.6-1 | — |
| Debian 13 | linux | 5.14.6-1 | — |
| Debian 12 | linux | 5.14.6-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | linux-aws-5.11 | 5.11.0-1020.21~20.04.2 | — |
| Ubuntu 20.04 LTS | linux-azure-5.11 +1 | 5.11.0-1020.21~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gcp-5.11 | 5.11.0-1021.23~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-hwe-5.11 | 5.11.0-38.42~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-oem-5.10 | 5.10.0-1050.52 | — |
| Ubuntu 20.04 LTS | linux-oem-5.13 | 5.13.0-1017.21 | — |
| Ubuntu 20.04 LTS | linux-riscv +9 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-riscv-5.11 | 5.11.0-1021.22~20.04.1 | — |
| Ubuntu 18.04 LTS | linux-gcp +12 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Hypervisor 4 | perf +2 | 4.18.0-372.91.1.el8_6 | RHSA-2024:0724 |
| RHEL 8.6 EUS | perf +26 | 4.18.0-372.91.1.el8_6 | RHSA-2024:0724 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | kernel-64kb +7 | 5.3.18-59.34.1 | SUSE-SU-2021:3675-1 |
| SLES 15 SP3 | kernel-azure +1 | 5.3.18-38.28.2 | SUSE-SU-2021:3641-1 |
| SLES 15 SP3 | kernel-default-base | 5.3.18-59.34.1.18.21.1 | SUSE-SU-2021:3675-1 |
| SLES 15 SP3 | kernel-syms-azure | 5.3.18-38.28.1 | SUSE-SU-2021:3641-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.1 | kernel-default | 5.3.18-59.34.1 | SUSE-SU-2021:3675-1 |
| SLE Micro 5.1 | kernel-default-base | 5.3.18-59.34.1.18.21.1 | SUSE-SU-2021:3675-1 |
| SLE Micro 5.1 | kernel-rt | 5.3.18-60.1 | SUSE-SU-2021:3642-1 |
| SLE Live Patching 15 SP3 | kernel-default | 5.3.18-59.34.1 | SUSE-SU-2021:3675-1 |
| SLE Live Patching 15 SP3 | kernel-livepatch-SLE15-SP3_Update_0 | 8-3.2 | SUSE-SU-2021:3738-1 |
| SLE Live Patching 15 SP3 | kernel-livepatch-SLE15-SP3_Update_1 +2 | 6-2.2 | SUSE-SU-2021:3742-1, SUSE-SU-2021:3718-1 |
| SLE Live Patching 15 SP3 | kernel-livepatch-SLE15-SP3_Update_4 | 5-2.2 | SUSE-SU-2021:3742-1 |
| SLE Live Patching 15 SP3 | kernel-livepatch-SLE15-SP3_Update_5 | 4-2.2 | SUSE-SU-2021:3742-1 |
| SLE Live Patching 15 SP3 | kernel-livepatch-SLE15-SP3_Update_6 | 2-2.2 | SUSE-SU-2021:3718-1 |
| SLE Live Patching 15 SP3 | kernel-livepatch-SLE15-SP3_Update_9 | 1-7.3.1 | SUSE-SU-2021:3675-1 |
| SUSE Real Time Module 15 SP3 | kernel-rt +3 | 5.3.18-60.1 | SUSE-SU-2021:3642-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.3 | dtb-aarch64 +11 | 5.3.18-59.34.1 | openSUSE-SU-2021:3675-1 |
| openSUSE Leap 15.3 | kernel-azure +1 | 5.3.18-38.28.2 | openSUSE-SU-2021:3641-1 |
| openSUSE Leap 15.3 | kernel-default-base | 5.3.18-59.34.1.18.21.1 | openSUSE-SU-2021:3675-1 |
| openSUSE Leap 15.3 | kernel-syms-azure | 5.3.18-38.28.1 | openSUSE-SU-2021:3641-1 |
Advisories 10
- RHSA-2024:0724 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- openSUSE-SU-2021:3641-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:3738-1 Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP3) SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:3675-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:3642-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:3641-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:3742-1 Security update for the Linux Kernel (Live Patch 5 for SLE 15 SP3) SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:3675-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2021:3718-1 Security update for the Linux Kernel (Live Patch 6 for SLE 15 SP3) SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2024-0314 Linux Kernel: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Feb 7, 2024