🟠 High | Source: Microsoft Security Response Center
CVE-2026-64192 addresses a flaw in the Linux kernel’s BPF (Berkeley Packet Filter) subsystem, specifically in how inode storage maps are created when the BPF Linux Security Module (LSM) is not properly initialised. If exploited, this could allow unintended behaviour or security bypass in environments relying on BPF-based security controls. The fix enforces a rejection of BPF_MAP_TYPE_INODE_STORAGE creation when the BPF LSM is uninitialised, closing a potential gap in kernel-level security enforcement.
Security Architect’s Take: Review any Azure Linux-based workloads — particularly those using AKS or Linux VMs — and ensure nodes are patched promptly, as BPF LSM flaws can undermine kernel-level security controls that other defences may depend upon. Verify whether your environment uses BPF-based security tooling (e.g. Cilium, Falco, or custom eBPF programmes) that could be affected by uninitialised LSM states.
Original advisory: CVE-2026-64192 bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized