Executive brief
The Linux kernel's BPF verifier fails to properly track reference state when executing synchronous callback functions multiple times. This allows attackers to potentially cause memory leaks or trigger use-after-free conditions by repeatedly acquiring and releasing references within callback functions, bypassing safety checks that assume single execution. The vulnerability affects the kernel's ability to prevent unauthorized memory access or system crashes on systems running untrusted BPF programs.
Technical details
The vulnerability exists in the Linux kernel's BPF verifier, which incorrectly manages reference state for synchronous callbacks in for_each style helpers. The verifier treats callback functions as executing only once during symbolic execution, but these callbacks actually execute multiple times. An attacker can exploit this by acquiring references within a callback that is executed repeatedly, or by releasing the same reference multiple times, causing the verifier to incorrectly account for acquired and released references. This leads to reference leaks or premature release of references that are still in use. The fix introduces a callback_ref member to distinguish caller vs callee references and enforces that all references acquired within callbacks must be released before BPF_EXIT, preventing reference state mutation that could bypass the verifier's safety checks.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2025-12-09: disclosed