Security readout for executives and security teams
Plain-English summary
A local, low-privileged user could remove certain Linux BPF networking programs without the administrative permission normally required. This could disable traffic handling or security controls built on tcx or netkit, causing network disruption or policy bypass. The issue requires local access and no user interaction.
Executive priority
Prioritize affected multi-user, container-hosting, or network-control systems because successful abuse could disable important traffic or security behavior. Patch through supported distribution channels after confirming applicability. Internet-only attackers are not directly positioned to exploit this local flaw without first obtaining system access.
Technical view
When BPF_PROG_DETACH was called for tcx or netkit without a program file descriptor, the kernel omitted the expected permission check. The correction requires CAP_NET_ADMIN or CAP_SYS_ADMIN. CVSS 3.1 is 7.3, reflecting local, low-complexity access with potentially high integrity and availability impact.
Likely exposure
Exposure is limited to Linux systems using affected kernel code and tcx or netkit BPF attachments where an untrusted local user can execute the vulnerable operation. The supplied version metadata is ambiguous, so distribution-specific backport status must be verified rather than inferred from version numbers alone.
Exploitation context
The attack is local, requires low privileges, needs no user interaction, and could detach networking programs. The bundle reports that this CVE is not in KEV, and no supplied source establishes active exploitation or a public exploit.
Researcher notes
The key condition is a BPF_PROG_DETACH request targeting tcx or netkit with no program file descriptor. Researchers should examine authorization behavior and referenced stable commits without assuming all listed kernel versions share identical exposure. The source bundle supplies no CWE and does not clearly map introduction and correction boundaries.
Mitigation direction
- Install a vendor kernel containing the applicable referenced stable fix.
- Check Linux distribution advisories for backport status and corrected package versions.
- Limit untrusted local access until patched, especially on systems using tcx or netkit.
- Review reliance on BPF networking programs for security enforcement or service availability.
Validation and detection
- Inventory kernel versions on systems using tcx or netkit BPF attachments.
- Confirm the installed kernel includes the applicable stable fix or vendor backport.
- Verify unauthorized users cannot detach these programs without the required capability.
- Review logs and network-policy state for unexpected BPF program detachments.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-45932 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H1.85.5LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4e0772cded109c238411f2fac36ac39302758b81CVE reference, Linux
- https://git.kernel.org/stable/c/3f04cc1e5374da4c5e791ae010a06cfea7bacbe6CVE reference, Linux
- https://git.kernel.org/stable/c/ae23bc81ddf7c17b663c4ed1b21e35527b0a7131CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.