CVE-2026-64192

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists when CONFIG BPF LSM=y is set but the BPF LSM is not explicitly enabled at boot time. In this state, the BPF inode security blob offset bpf lsm blob sizes.lbs inode is not initialized, remaining at a default size of 8 bytes. When a privileged user creates and updates a BPF MAP TYPE INODE STORAGE map, the bpf inode() function evaluates inode->i security + 8, which incorrectly aliases the struct rcu head.func callback pointer. During map element cleanup or inode destruction, writing NULL to owner storage clears the queued RCU callback pointer. When rcu do batch() subsequently executes the callback, it attempts an instruction fetch at address 0x0, resulting in a kernel panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.