OESA-2026-2931

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-2931
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-2931.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-2931
Upstream
Published
2026-07-09T12:53:14Z
Modified
2026-07-14T08:15:08.477005492Z
Summary
kernel security update
Details

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix bpfxdpstore_bytes proto for read-only arg

While making some maps in Cilium read-only from the BPF side, we noticed that the bpfxdpstore_bytes proto is incorrect. In particular, the verifier was throwing the following error:

; ret = ctxstorebytes(ctx, l3off + offsetof(struct iphdr, saddr), &nat->address, 4, 0); 635: (79) r1 = *(u64 *)(r10 -144) ; R1=ctx() R10=fp0 fp-144=ctx() 636: (b4) w2 = 26 ; R2=26 637: (b4) w4 = 4 ; R4=4 638: (b4) w5 = 0 ; R5=0 639: (85) call bpfxdpstorebytes#190 write into map forbidden, value_size=6 off=0 size=4

nat comes from a BPFFRDONLYPROG map, so R3 is a PTRTOMAPVALUE. The verifier checks the helper's memory access to R3 in checkmemsizereg, as it reaches ARGCONSTSIZE argument. The third argument has expected type ARGPTRTOUNINITMEM, which includes the MEMWRITE flag. The verifier thus checks for a BPF_WRITE access on R3. Given R3 points to a read-only map, the check fails.

Conversely, ARGPTRTOUNINITMEM can also lead to the helper reading from uninitialized memory.

This patch simply fixes the expected argument type to match that of bpfskbstore_bytes.(CVE-2026-45886)

Database specific 
{
    "severity": "Medium"
}
References

Affected packages

openEuler:24.03-LTS-SP3 / kernel

Package

Name
kernel
Purl
pkg:rpm/openEuler/kernel&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
None
None

Ecosystem specific 

{
    "x86_64": [
        "bpftool-6.6.0-145.3.18.151.oe2403sp3.x86_64.rpm",
        "bpftool-debuginfo-6.6.0-145.3.18.151.oe2403sp3.x86_64.rpm",
        "kernel-6.6.0-145.3.18.151.oe2403sp3.x86_64.rpm",
        "kernel-debuginfo-6.6.0-145.3.18.151.oe2403sp3.x86_64.rpm",
        "kernel-debugsource-6.6.0-145.3.18.151.oe2403sp3.x86_64.rpm",
        "kernel-devel-6.6.0-145.3.18.151.oe2403sp3.x86_64.rpm",
        "kernel-extra-modules-6.6.0-145.3.18.151.oe2403sp3.x86_64.rpm",
        "kernel-headers-6.6.0-145.3.18.151.oe2403sp3.x86_64.rpm",
        "kernel-source-6.6.0-145.3.18.151.oe2403sp3.x86_64.rpm",
        "kernel-tools-6.6.0-145.3.18.151.oe2403sp3.x86_64.rpm",
        "kernel-tools-debuginfo-6.6.0-145.3.18.151.oe2403sp3.x86_64.rpm",
        "kernel-tools-devel-6.6.0-145.3.18.151.oe2403sp3.x86_64.rpm",
        "perf-6.6.0-145.3.18.151.oe2403sp3.x86_64.rpm",
        "perf-debuginfo-6.6.0-145.3.18.151.oe2403sp3.x86_64.rpm",
        "python3-perf-6.6.0-145.3.18.151.oe2403sp3.x86_64.rpm",
        "python3-perf-debuginfo-6.6.0-145.3.18.151.oe2403sp3.x86_64.rpm"
    ],
    "aarch64": [
        "bpftool-6.6.0-145.3.18.151.oe2403sp3.aarch64.rpm",
        "bpftool-debuginfo-6.6.0-145.3.18.151.oe2403sp3.aarch64.rpm",
        "kernel-6.6.0-145.3.18.151.oe2403sp3.aarch64.rpm",
        "kernel-debuginfo-6.6.0-145.3.18.151.oe2403sp3.aarch64.rpm",
        "kernel-debugsource-6.6.0-145.3.18.151.oe2403sp3.aarch64.rpm",
        "kernel-devel-6.6.0-145.3.18.151.oe2403sp3.aarch64.rpm",
        "kernel-extra-modules-6.6.0-145.3.18.151.oe2403sp3.aarch64.rpm",
        "kernel-headers-6.6.0-145.3.18.151.oe2403sp3.aarch64.rpm",
        "kernel-source-6.6.0-145.3.18.151.oe2403sp3.aarch64.rpm",
        "kernel-tools-6.6.0-145.3.18.151.oe2403sp3.aarch64.rpm",
        "kernel-tools-debuginfo-6.6.0-145.3.18.151.oe2403sp3.aarch64.rpm",
        "kernel-tools-devel-6.6.0-145.3.18.151.oe2403sp3.aarch64.rpm",
        "perf-6.6.0-145.3.18.151.oe2403sp3.aarch64.rpm",
        "perf-debuginfo-6.6.0-145.3.18.151.oe2403sp3.aarch64.rpm",
        "python3-perf-6.6.0-145.3.18.151.oe2403sp3.aarch64.rpm",
        "python3-perf-debuginfo-6.6.0-145.3.18.151.oe2403sp3.aarch64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-2931.json"