Live › vulnerability › CVE-2026-99129
Go to dashboardThe Linux kernel's SELinux BPF token permission checks looked up the bpffs creator security ID through the token's file descriptor more than once, which could be changed between checks. The fix resolves the lookup once from the path or token itself, closing a time-of-check to time-of-use gap.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel with SELinux enabled and BPF token delegation (bpffs token creation) in use. The sources do not say which kernel versions are affected or whether a default configuration is exposed.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
selinux: fix BPF token permission checks
Avoid multiple lookups of the bpffs creator SID using the token's file descriptor when the same information can be found via the resolved path/dentry (in selinux_bpf_token_create()) or the token itself (in selinux_bpf_map_create() and selinux_bpf_prog_load()). Not only does this simplify the code, it avoids potential TOCTOU issues if the user changes the token file descriptor passed into the kernel.
This page as .md · .json · in your agent: get_signal("CVE-2026-99129")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.