ZDI-26-1007: Linux Kernel BPF Race Condition — Privilege Escalation Detection and Remediation Guide

---
title: BPF Program Load by Non-System Process
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects loading of BPF programs by processes not typically associated with BPF operations, which may indicate exploitation of ZDI-26-1007 (BPF local storage race condition for privilege escalation).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-1007/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection_bpf_syscall:
    CommandLine|contains:
      - 'bpf_prog_load'
      - 'BPF_PROG_LOAD'
      - 'bpf_map_create'
      - 'BPF_MAP_CREATE'
  selection_unexpected_parent:
    ParentImage|endswith:
      - '/python'
      - '/python3'
      - '/perl'
      - '/bash'
      - '/sh'
      - '/php'
      - '/ruby'
      - '/node'
  condition: selection_bpf_syscall and selection_unexpected_parent
falsepositives:
  - Legitimate BPF development or debugging by security engineers
  - eBPF-based monitoring agents (Cilium, Falco, Datadog) during initialization
level: high
---
title: Privilege Escalation via Unexpected UID Transition After BPF Activity
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: Detects processes that transition from non-root to root UID shortly after BPF-related syscalls are observed, consistent with race condition exploitation for privilege escalation (ZDI-26-1007).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-1007/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/id'
      - '/whoami'
      - '/cat'
      - '/bash'
      - '/sh'
      - '/python'
      - '/python3'
      - '/nc'
      - '/ncat'
    User: 'root'
  filter_known:
    ParentImage|endswith:
      - '/sshd'
      - '/sudo'
      - '/su'
      - '/systemd'
      - '/cron'
      - '/containerd'
      - '/dockerd'
  condition: selection and not filter_known
falsepositives:
  - System administrators performing legitimate root operations
  - Automated configuration management tools (Ansible, Puppet, Chef) executing as root
level: high
---
title: Suspicious Unprivileged BPF Access Attempt
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: Detects attempts to interact with BPF subsystem by unprivileged users, which may indicate reconnaissance or exploitation attempts targeting ZDI-26-1007.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-1007/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.discovery
logsource:
  category: process_creation
  product: linux
detection:
  selection_bpf_tools:
    Image|endswith:
      - '/bpftool'
      - '/bpftrace'
      - '/bpfcc'
  selection_unprivileged:
    CommandLine|contains:
      - 'map dump'
      - 'map lookup'
      - 'prog show'
      - 'prog load'
      - 'map create'
  filter_admin:
    User|contains:
      - 'root'
      - 'admin'
  condition: selection_bpf_tools and selection_unprivileged and not filter_admin
falsepositives:
  - Security engineers performing legitimate BPF debugging
  - eBPF-based observability agents running under service accounts
level: medium

// Hunt 1: Detect BPF-related syscalls from unexpected processes (ZDI-26-1007)
// Requires: Syslog or auditd ingestion into Sentinel
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("bpf_prog_load", "BPF_PROG_LOAD", "bpf_map_create", "BPF_MAP_CREATE", "bpf()")
| extend ProcessName = extract(@"([a-zA-Z0-9_\-\.]+)\[", 1, SyslogMessage)
| where ProcessName !in~ ("cilium-agent", "falco", "datadog-agent", "bpftrace", "bpftool", "systemd")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc

// Hunt 2: Detect unexpected UID transitions to root — potential privilege escalation
// Looks for processes executing as root whose parent is not a known privilege escalation path
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("uid=0", "euid=0")
| where SyslogMessage !has_any ("sudo", "su[", "sshd", "systemd", "cron", "containerd", "dockerd", "cloud-init")
| extend ProcessName = extract(@"([a-zA-Z0-9_\-\.]+)\[", 1, SyslogMessage)
| summarize EventCount = count(), DistinctMessages = make_set(SyslogMessage, 5) by Computer, ProcessName, bin(TimeGenerated, 1h)
| where EventCount > 0
| order by TimeGenerated desc

// Hunt 3: Detect bpftool/bpftrace execution by non-admin users
// Indicates reconnaissance or exploitation of BPF subsystem
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("bpftool", "bpftrace")
| where SyslogMessage !has "root"
| extend ProcessName = extract(@"([a-zA-Z0-9_\-\.]+)\[", 1, SyslogMessage)
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

-- Hunt: ZDI-26-1007 BPF Race Condition Exploitation Indicators
-- Identifies processes interacting with BPF subsystem and unexpected UID transitions

-- Part 1: Check for active BPF programs and their loading processes
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(bpftool|bpftrace|bpf_prog_load|bpf_map_create)'
   OR Exe =~ '(bpftool|bpftrace)'

-- Part 2: Identify processes running as root with suspicious parent processes
-- (potential post-exploitation activity after privilege escalation)
SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime,
       parent.Name AS ParentName,
       parent.CommandLine AS ParentCommandLine
FROM pslist()
WHERE Username =~ 'root'
  AND parent.Name !~ '(sshd|sudo|su|systemd|cron|containerd|dockerd|init|cloud-init|ansible|salt)'
  AND Name =~ '(bash|sh|python|perl|nc|ncat|id|whoami)'

-- Part 3: Check loaded BPF programs via /sys/fs/bpf and /proc
SELECT Name, Size, ModTime
FROM glob(globs='/sys/fs/bpf/*')

-- Part 4: Check for unusual capabilities on processes (CAP_BPF, CAP_SYS_ADMIN)
SELECT Pid, Name, CommandLine, Username,
       read_file(filename='/proc/' + str(string=Pid) + '/status') AS ProcStatus
FROM pslist()
WHERE Username !~ 'root'
  AND read_file(filename='/proc/' + str(string=Pid) + '/status') =~ 'CapEff.*(200|CAP_BPF)'

#!/bin/bash
# ============================================================
# ZDI-26-1007 — Linux Kernel BPF Local Storage Race Condition
# Detection, Verification & Hardening Script
# Run as root on target systems
# ============================================================

set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo "============================================"
echo " ZDI-26-1007 BPF Race Condition Assessment"
echo " $(date)"
echo "============================================"

# --- 1. Check current kernel version ---
echo -e "\n[*] Current Kernel Version:"
KERNEL_VERSION=$(uname -r)
echo "    $KERNEL_VERSION"

# --- 2. Check if BPF is enabled ---
echo -e "\n[*] Checking BPF subsystem status..."
if [ -d /sys/fs/bpf ]; then
    echo -e "    ${YELLOW}BPF filesystem is mounted — BPF is active on this system${NC}"
    ls -la /sys/fs/bpf/ 2>/dev/null || echo "    (No pinned BPF objects found)"
else
    echo -e "    ${GREEN}BPF filesystem not mounted${NC}"
fi

# --- 3. Check unprivileged BPF setting ---
echo -e "\n[*] Checking unprivileged BPF access..."
UNPRIV_BPF=$(cat /proc/sys/kernel/unprivileged_bpf_disabled 2>/dev/null || echo "not_found")
if [ "$UNPRIV_BPF" = "0" ]; then
    echo -e "    ${RED}WARNING: Unprivileged BPF is ENABLED (unprivileged_bpf_disabled=0)${NC}"
    echo -e "    ${RED}This significantly increases the attack surface for ZDI-26-1007${NC}"
elif [ "$UNPRIV_BPF" = "1" ]; then
    echo -e "    ${GREEN}Unprivileged BPF is disabled (unprivileged_bpf_disabled=1)${NC}"
elif [ "$UNPRIV_BPF" = "2" ]; then
    echo -e "    ${GREEN}Unprivileged BPF disabled (admin-only, value=2)${NC}"
else
    echo -e "    ${YELLOW}unprivileged_bpf_disabled sysctl not found — check kernel config${NC}"
fi

# --- 4. Apply interim mitigation: Disable unprivileged BPF ---
echo -e "\n[*] Applying interim mitigation: Disabling unprivileged BPF..."
sysctl -w kernel.unprivileged_bpf_disabled=1 2>/dev/null && {
    echo -e "    ${GREEN}Set kernel.unprivileged_bpf_disabled=1 (runtime)${NC}"
} || echo -e "    ${YELLOW}Failed to set sysctl — may require kernel update${NC}"

# Persist across reboots
if [ -f /etc/sysctl.conf ] || [ -d /etc/sysctl.d ]; then
    echo 'kernel.unprivileged_bpf_disabled=1' > /etc/sysctl.d/99-bpf-hardening.conf
    echo -e "    ${GREEN}Persisted to /etc/sysctl.d/99-bpf-hardening.conf${NC}"
fi

# --- 5. Check BPF JIT hardening ---
echo -e "\n[*] Checking BPF JIT compiler hardening..."
BPF_JIT=$(cat /proc/sys/net/core/bpf_jit_enable 2>/dev/null || echo "not_found")
if [ "$BPF_JIT" = "1" ] || [ "$BPF_JIT" = "2" ]; then
    echo -e "    ${YELLOW}BPF JIT is enabled (value=$BPF_JIT) — consider hardening if not required${NC}"
else
    echo -e "    BPF JIT status: $BPF_JIT"
fi

# --- 6. List loaded BPF programs ---
echo -e "\n[*] Currently loaded BPF programs (requires bpftool):"
if command -v bpftool &>/dev/null; then
    bpftool prog show 2>/dev/null || echo "    No BPF programs loaded or insufficient permissions"
    echo ""
    echo "[*] BPF maps:"
    bpftool map show 2>/dev/null || echo "    No BPF maps found or insufficient permissions"
else
    echo "    bpftool not installed — install linux-tools or bpftool package for full BPF inventory"
fi

# --- 7. Check for suspicious processes with BPF capabilities ---
echo -e "\n[*] Checking for non-root processes with CAP_BPF or CAP_SYS_ADMIN..."
for pid in $(ls /proc/ | grep -E '^[0-9]+$'); do
    if [ -f "/proc/$pid/status" ]; then
        CAP_EFF=$(grep CapEff /proc/$pid/status 2>/dev/null | awk '{print $2}')
        UID_VAL=$(grep '^Uid:' /proc/$pid/status 2>/dev/null | awk '{print $2}')
        PROC_NAME=$(cat /proc/$pid/comm 2>/dev/null)
        # Check if non-root process has elevated capabilities
        if [ "$UID_VAL" != "0" ] && [ -n "$CAP_EFF" ] && [ "$CAP_EFF" != "0000000000000000" ]; then
            echo -e "    ${YELLOW}PID $pid ($PROC_NAME) UID=$UID_VAL CapEff=$CAP_EFF${NC}"
        fi
    fi
done
echo "    (Scan complete)"

# --- 8. Check for kernel updates ---
echo -e "\n[*] Checking for available kernel updates..."
if command -v apt-get &>/dev/null; then
    apt list --upgradable 2>/dev/null | grep -i linux-image || echo "    No kernel updates available via apt"
elif command -v yum &>/dev/null; then
    yum check-update kernel 2>/dev/null || echo "    No kernel updates available via yum"
elif command -v dnf &>/dev/null; then
    dnf check-update kernel 2>/dev/null || echo "    No kernel updates available via dnf"
else
    echo "    Package manager not detected — check manually"
fi

# --- 9. Summary ---
echo -e "\n============================================"
echo " ASSESSMENT COMPLETE"
echo "============================================"
echo ""
echo "Next Steps:"
echo "  1. Apply kernel patches from your distribution as soon as available"
echo "  2. Reboot to activate the patched kernel"
echo "  3. Verify unprivileged_bpf_disabled=1 persists after reboot"
echo "  4. Review BPF programs loaded on this host for anomalies"
echo "  5. Monitor ZDI advisory for CVE assignment and patch details:"
echo "     http://www.zerodayinitiative.com/advisories/ZDI-26-1007/"
echo ""

# Runtime mitigation (immediate)
sysctl -w kernel.unprivileged_bpf_disabled=1

# Persist across reboots
echo 'kernel.unprivileged_bpf_disabled=1' > /etc/sysctl.d/99-bpf-hardening.conf
sysctl --system

# Find binaries with BPF-related capabilities
getcap -r / 2>/dev/null | grep -E '(cap_bpf|cap_sys_admin|cap_sys_module)'

# Audit Kubernetes pods with elevated capabilities
kubectl get pods --all-namespaces -o json | jq '.items[] | select(.spec.containers[].securityContext.capabilities.add != null) | {namespace: .metadata.namespace, pod: .metadata.name, caps: .spec.containers[].securityContext.capabilities.add}'

# Check lockdown status
cat /sys/kernel/security/lockdown

# Enable via kernel parameter (requires Secure Boot)
# Add to GRUB: lockdown=integrity