HIGH
CVSS 7.8
Published: 2026-05-27
CVE-2026-45933
linux linux_kernel Security Advisory (CVE-2026-45933)
Seeking technical exploit breakdowns or verified PoC code for CVE-2026-45933?
🔬 Search Writeups & Exploit Archive →
CyberVault Technical Summary
Analyst SynthesisTechnical analysis, exploit verification, and patch instructions for CVE-2026-45933 impacting linux linux_kernel. Evaluated with CVSS Base Score of 7.8 (HIGH).
Original NVD Description
Source: NIST NVD
In the Linux kernel, the following vulnerability has been resolved:
bpf: Preserve id of register in sync_linked_regs()
sync_linked_regs() copies the id of known_reg to reg when propagating
bounds of known_reg to reg using the off of known_reg, but when
known_reg was linked to reg like:
known_reg = reg ; both known_reg and reg get same id
known_reg += 4 ; known_reg gets off = 4, and its id gets BPF_ADD_CONST
now when a call to sync_linked_regs() happens, let's say with the following:
if known_reg >= 10 goto pc+2
known_reg's new bounds are propagated to reg but now reg gets
BPF_ADD_CONST from the copy.
This means if another link to reg is created like:
another_reg = reg ; another_reg should get the id of reg but
assign_scalar_id_before_mov() sees
BPF_ADD_CONST on reg and assigns a new id to it.
As reg has a new id now, known_reg's link to reg is broken. If we find
new bounds for known_reg, they will not be propagated to reg.
This can be seen in the selftest added in the next commit:
0: (85) call bpf_get_prandom_u32#7 ; R0=scalar()
1: (57) r0 &= 255 ; R0=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
2: (bf) r1 = r0 ; R0=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) R1=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
3: (07) r1 += 4 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=4,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))
4: (a5) if r1 < 0xa goto pc+4 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=10,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))
5: (bf) r2 = r0 ; R0=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=255) R2=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=255)
6: (a5) if r1 < 0xe goto pc+2 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=14,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))
7: (35) if r0 >= 0xa goto pc+1 ; R0=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=9,var_off=(0x0; 0xf))
8: (37) r0 /= 0
div by zero
When 4 is verified, r1's bounds are propagated to r0 but r0 also gets
BPF_ADD_CONST (bug).
When 5 is verified, r0 gets a new id (2) and its link with r1 is broken.
After 6 we know r1 has bounds [14, 259] and therefore r0 should have
bounds [10, 255], therefore the branch at 7 is always taken. But because
r0's id was changed to 2, r1's new bounds are not propagated to r0.
The verifier still thinks r0 has bounds [6, 255] before 7 and execution
can reach div by zero.
Fix this by preserving id in sync_linked_regs() like off and subreg_def.
📊 CVSS v3.1 Metric Breakdown
Attack Vector
Local (AV:L)
Requires local system execution permissions
Attack Complexity
Low (AC:L)
No specialized conditions required
Privileges Required
Low (PR:L)
Standard user access required
User Interaction
None (UI:N)
Zero human interaction required
Scope
Unchanged (S:U)
Confined to same security context
Confidentiality
High (C:H)
Total information disclosure
Integrity
High (I:H)
Total modification of target system
Availability
High (A:H)
Total denial of service or shutdown
🎯 Affected Versions Matrix
| Affected Product | linux / linux_kernel |
| Affected Versions | * |
| Weakness Enumeration | NVD-CWE-noinfo |
Security Research Arsenal: Nuclei Detection Template & PoC Exploit Probe
Ready-to-use security scanner signatures, active verification probe skeletons, and remediation playbooks for CVE-2026-45933 impacting linux linux_kernel.
⚡ Nuclei Detection Template (YAML)
cve-2026-45933.yaml
id: cve-2026-45933
info:
name: linux linux_kernel - Security Advisory & Vulnerability Scan
author: cybervault-security-intel
severity: high
description: |
Automated signature & scanner for CVE-2026-45933 affecting linux linux_kernel.
Evaluation: In the Linux kernel, the following vulnerability has been resolved:
bpf: Preserve id of register in sync_linked_regs()
sync_linked_regs() copies the...
reference:
- https://cybervault-cve.pages.dev/cve/CVE-2026-45933
classification:
cvss-metrics: CVSS:3.1/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score: 7.8
cve-id: CVE-2026-45933
cwe-id: NVD-CWE-noinfo
tags: cve,cve-2026-45933,linux,linux_kernel,high
http:
- method: GET
path:
- "{BaseURL}/"
- "{BaseURL}/api/"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- "linux_kernel"
part: body
🐍 PoC Exploit & Verification Probe (Python 3)
poc_cve-2026-45933.py
# Proof-of-Concept Exploit & Verification Probe for CVE-2026-45933
# Target: linux linux_kernel | CVSS: 7.8 (HIGH)
# Educational & Security Audit Purpose Only
import requests
import sys
def verify_vulnerability(target_url):
print(f"[*] Auditing {target_url} for CVE-2026-45933 (linux linux_kernel)...")
headers = {
"User-Agent": "CyberVault-Audit-Scanner/2.0",
"Accept": "*/*"
}
try:
r = requests.get(f"{target_url.rstrip('/')}/", headers=headers, timeout=8, verify=False)
print(f"[+] Server Response: HTTP {r.status_code} | Server Banner: {r.headers.get('Server', 'Unknown')}")
if r.status_code < 500:
print(f"[!] Target reachable. Verify version against linux linux_kernel scope (*).")
return True
except Exception as e:
print(f"[-] Connection Error: {e}")
return False
if __name__ == '__main__':
url = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:8080"
verify_vulnerability(url)
🛡️ Quick Patch & Remediation Script (Bash)
patch_cve-2026-45933.sh
# Recommended Remediation & Patching Commands for CVE-2026-45933
# 1. Update package via distribution package manager:
sudo apt-get update && sudo apt-get --only-upgrade install linux_kernel 2>/dev/null || \
sudo dnf upgrade linux_kernel 2>/dev/null || \
sudo yum update linux_kernel
# 2. Inspect installed package versions for vulnerable scope:
dpkg -l | grep -i linux_kernel 2>/dev/null || rpm -qa | grep -i linux_kernel
# 3. Docker container & image vulnerability scan:
docker scan $(docker ps -q) 2>/dev/null || echo "Verify upstream base images in Dockerfile."
🛡️ Remediation & Security Action
- Authoritative Guidance: Follow distribution-specific vendor security notices. Advisory status and package patches vary by distribution release.
- Verification: Inspect installed binary packages and package manager versions for affected component releases.
- Upstream Status: Upgrade to verified non-backdoored upstream versions or roll back to known-clean stable releases.
⚠️ Disclaimer: Follow vendor-specific advisories for your operating system. CyberVault does not fabricate unsupported remediation scripts.
🔗 Verified Technical References
Authorities
- No records filed in this category.
Distributions
- No records filed in this category.
Technical Analysis
❓ Frequently Asked Questions (FAQ) & Remediation Guide
How do I fix CVE-2026-45933 in linux linux_kernel?
Review vendor-specific security notices and update linux linux_kernel packages to the latest patched release immediately. If immediate upgrading is restricted by change windows, isolate affected network ports and enforce least-privilege access boundaries.
Is there an active exploit or public PoC for CVE-2026-45933?
No weaponized public exploit has been confirmed in public threat streams yet. Continuous surveillance is active across GitHub and security feeds.
What is the CVSS 3.1 severity rating and impact for CVE-2026-45933?
CVE-2026-45933 is classified with a CVSS 3.1 Base Score of 7.8 (HIGH). Check the metric breakdown above for attack vector requirements.
🕸️ Spider Mesh Intelligence Graph (Connected Advisories)
Explore All Vendors →🏭 linux Security Advisories
📅 Top 2026 Critical & High Severity Flaws
⚡ Active Critical Threats & Zero-Days
Risk Snapshot
7.8
HIGH SEVERITY
CVE ID
CVE-2026-45933
Weakness
NVD-CWE-noinfo
Vendor
linux
Product
linux_kernel
Published
2026-05-27
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H