---
id: "CVE-2026-99129"
kind: "vulnerability"
aliases: ["CVE-2026-99129"]
title: "Linux kernel: SELinux BPF token checks could be bypassed by swapping file descriptors"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["bpf", "linux-kernel", "runtime", "selinux"]
not_affected_if: ["bpf-tokens-unused", "selinux-disabled"]
published_at: "2026-10-28T11:17:32+00:00"
first_seen_at: "2026-10-28T11:32:35+00:00"
updated_at: "2026-10-28T11:36:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99129", "first_seen_at": "2026-10-28T11:32:35+00:00"}]
---

# Linux kernel: SELinux BPF token checks could be bypassed by swapping file descriptors

The Linux kernel's SELinux BPF token permission checks looked up the bpffs creator security ID through the token's file descriptor more than once, which could be changed between checks. The fix resolves the lookup once from the path or token itself, closing a time-of-check to time-of-use gap.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-28T11:32:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99129

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

selinux: fix BPF token permission checks

Avoid multiple lookups of the bpffs creator SID using the token's file
descriptor when the same information can be found via the resolved
path/dentry (in selinux_bpf_token_create()) or the token itself (in
selinux_bpf_map_create() and selinux_bpf_prog_load()).  Not only does
this simplify the code, it avoids potential TOCTOU issues if the user
changes the token file descriptor passed into the kernel.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_