{"id":"CVE-2026-45932","title":"bpf: Fix tcx/netkit detach permissions when prog fd isn't given","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix tcx/netkit detach permissions when prog fd isn't given\n\nThis commit fixes a security issue where BPF_PROG_DETACH on tcx or\nnetkit devices could be executed by …","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= e420bed025071a623d2720a92bc2245c84757ecb < 8e1623e7d61faf16cbadc80550da874303611ff5","Linux >= e420bed025071a623d2720a92bc2245c84757ecb < 0c249f523175963b0a746bba673ecebdf6cefd86","Linux >= e420bed025071a623d2720a92bc2245c84757ecb < 4e0772cded109c238411f2fac36ac39302758b81","Linux >= e420bed025071a623d2720a92bc2245c84757ecb < 3f04cc1e5374da4c5e791ae010a06cfea7bacbe6","Linux >= e420bed025071a623d2720a92bc2245c84757ecb < ae23bc81ddf7c17b663c4ed1b21e35527b0a7131","Linux 6.6"],"published":"2026-05-27","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:40:59.729Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45932","references":[{"url":"https://git.kernel.org/stable/c/8e1623e7d61faf16cbadc80550da874303611ff5"},{"url":"https://git.kernel.org/stable/c/0c249f523175963b0a746bba673ecebdf6cefd86"},{"url":"https://git.kernel.org/stable/c/4e0772cded109c238411f2fac36ac39302758b81"},{"url":"https://git.kernel.org/stable/c/3f04cc1e5374da4c5e791ae010a06cfea7bacbe6"},{"url":"https://git.kernel.org/stable/c/ae23bc81ddf7c17b663c4ed1b21e35527b0a7131"}],"tags":["cve.org"],"epss":0.00181,"epssPercentile":0.07281,"ingestedAt":"2026-10-21T12:48:53.634Z","slug":"CVE-2026-45932","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix tcx/netkit detach permissions when prog fd isn't given\n\nThis commit fixes a security issue where BPF_PROG_DETACH on tcx or\nnetkit devices could be executed by any user when no program fd was\nprovided, bypassing permission checks. The fix adds a capability\ncheck for CAP_NET_ADMIN or CAP_SYS_ADMIN in this case.\n\n## Affected\n\n- `Linux >= e420bed025071a623d2720a92bc2245c84757ecb < 8e1623e7d61faf16cbadc80550da874303611ff5`\n- `Linux >= e420bed025071a623d2720a92bc2245c84757ecb < 0c249f523175963b0a746bba673ecebdf6cefd86`\n- `Linux >= e420bed025071a623d2720a92bc2245c84757ecb < 4e0772cded109c238411f2fac36ac39302758b81`\n- `Linux >= e420bed025071a623d2720a92bc2245c84757ecb < 3f04cc1e5374da4c5e791ae010a06cfea7bacbe6`\n- `Linux >= e420bed025071a623d2720a92bc2245c84757ecb < ae23bc81ddf7c17b663c4ed1b21e35527b0a7131`\n- `Linux 6.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}