Executive brief
A vulnerability in the Linux kernel's ARM64 BPF component could allow a local user to cause a system crash. The issue occurs when specific background programs (BPF) fail to properly set up memory references, leading to a kernel failure. This could disrupt operations or potentially be used as part of a more complex attack to gain deeper access to the system.
Technical details
A vulnerability exists in the ARM64 BPF JIT compiler where the frame pointer (FP) is not correctly initialized for BPF programs acting as an exception boundary. When 'exception_boundary' is set, the JIT skips the 'find_used_callee_regs()' function, which is responsible for marking 'ctx->fp_used' as true. Consequently, the prologue fails to set up the FP even if it is used by the program, leading to a NULL pointer dereference or page fault. A local attacker with the ability to load BPF programs could exploit this to trigger a kernel crash (DoS). The issue has been patched in various stable branches including 6.12.42, 6.15.10, and 6.16.1.
Affected products
- Linux Linux Kernel 6.12, 6.13, 6.15, 6.16
Timeline
- 2025-07-22: other: Original patch authored
- 2025-08-19: disclosed: CVE published