CVE intelligence

CVE-2026-80675

Vulnerability intelligence

Published Aug 28, 2026Sources checked Oct 8, 2026

7.1HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2026-80675 and is rated High severity with a CVSS score of 7.1. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-80675?

In the Linux kernel, the following vulnerability has been resolved:

libbpf: Reject non-exclusive metadata maps in the signed loader

The loader verifies map->sha against the metadata hash in its instructions. map->sha is calculated when BPF_OBJ_GET_INFO_BY_FD is called on the frozen map.

While the map is frozen, the /signed loader/ must also ensure the map is exclusive, as, without exclusivity (which a hostile host could just omit when loading the loader), another BPF program with map access can mutate the contents afterwards, so the check passes on stale data.

With the extra check as part of the signed loader, it now refuses to move on with map->sha validation if the host set it up wrongly.

Source: NVD