{"id":"CVE-2026-99129","kind":"vulnerability","aliases":["CVE-2026-99129"],"related":[],"title":"Linux kernel: SELinux BPF token checks could be bypassed by swapping file descriptors","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: fix BPF token permission checks\n\nAvoid multiple lookups of the bpffs creator SID using the token's file\ndescriptor when the same information can be found via the resolved\npath/dentry (in selinux_bpf_token_create()) or the token itself (in\nselinux_bpf_map_create() and selinux_bpf_prog_load()).  Not only does\nthis simplify the code, it avoids potential TOCTOU issues if the user\nchanges the token file descriptor passed into the kernel.","summary":"The Linux kernel's SELinux BPF token permission checks looked up the bpffs creator security ID through the token's file descriptor more than once, which could be changed between checks. The fix resolves the lookup once from the path or token itself, closing a time-of-check to time-of-use gap.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","linux-kernel","runtime","selinux"],"not_affected_if":["bpf-tokens-unused","selinux-disabled"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T11:17:32+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:36:18+00:00","updated_at":"2026-10-28T11:36:18+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-28T11:36:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: SELinux BPF token checks could be bypassed by swapping file descriptors","impact":"medium","summary":"The Linux kernel's SELinux BPF token permission checks looked up the bpffs creator security ID through the token's file descriptor more than once, which could be changed between checks. The fix resolves the lookup once from the path or token itself, closing a time-of-check to time-of-use gap.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","selinux","bpf"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Find the affected kernel version ranges and the upstream fix commit from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-99129) and the kernel stable tree.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["selinux-disabled","bpf-tokens-unused"],"who_is_affected":"Systems running a Linux kernel with SELinux enabled and BPF token delegation (bpffs token creation) in use. The sources do not say which kernel versions are affected or whether a default configuration is exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000572,"input_tokens":3397,"output_tokens":465,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-99129':16A,19A 'avoid':97C,149C 'bpf':4A,20B,31B,93C,124C,133C,138C 'bpffs':38B,102C 'bypass':9A 'chang':54B,156C 'check':6A,34B,56B,74B,96C 'close':69B 'code':147C 'could':7A,52B 'creat':126C,135C 'creator':39B,103C 'cve':14A,17A 'descriptor':13A,47B,110C,160C 'file':12A,46B,109C,159C 'fix':58B,92C 'follow':86C 'found':117C 'gap':80B 'id':41B 'inform':114C 'issu':152C 'kernel':2A,23B,28B,84C,164C 'linux':1A,22B,27B,83C 'linux-kernel':21B 'load':140C 'look':35B 'lookup':61B,99C 'map':134C 'multipl':98C 'pass':161C 'path':65B 'path/dentry':121C 'permiss':33B,95C 'potenti':150C 'prog':139C 'resolv':59B,90C,120C 'runtim':24B 'secur':40B 'selinux':3A,25B,30B,91C,123C,132C,137C 'sid':104C 'simplifi':145C 'swap':11A 'time':72B,77B 'time-of-check':71B 'time-of-us':76B 'toctou':151C 'token':5A,32B,44B,67B,94C,107C,125C,129C,158C 'use':79B,105C 'user':155C 'via':118C 'vulner':87C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with SELinux enabled and BPF token delegation (bpffs token creation) in use. The sources do not say which kernel versions are affected or whether a default configuration is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99129","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99129","severity":null,"published_at":"2026-10-28T11:17:32+00:00","modified_at":"2026-10-28T11:17:32+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}