Executive brief
A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, which is used for high-performance networking and system monitoring. An attacker with local access could potentially trigger a system crash or instability by running a specially crafted BPF program. This issue primarily impacts the availability of the system and any services running on it.
Technical details
A vulnerability exists in the Linux kernel BPF verifier's handling of narrow access to pointer fields within context structures (e.g., __sk_buff, bpf_sockopt). The root cause is that bpf_skb_is_valid_access and similar functions allowed unaligned or narrow reads that did not exactly match the expected offset of pointer fields. While the verifier initially allowed these accesses, the subsequent conversion phase (bpf_convert_ctx_access) failed to handle them correctly, resulting in a 'verifier bug' kernel warning and potential instability. An attacker with the ability to load BPF programs (typically requiring CAP_BPF or CAP_SYS_ADMIN) can exploit this to trigger kernel-level errors. The fix involves using bpf_ctx_range_ptr to strictly reject narrow access to these pointer fields.
Affected products
- Linux Linux Kernel f96da09473b52c09125cc9bf7d7d4576ae8229e0 to 7847c4140e06f6e87229faae22cc38525334c156
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-07-22: patched: Initial patch authored
- 2025-08-19: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/058a0da4f6d916a79b693384111bb80a90d73763
- https://git.kernel.org/stable/c/202900ceeef67458c964c2af6e1427c8e533ea7c
- https://git.kernel.org/stable/c/33660d44e789edb4f303210c813fc56d56377a90
- https://git.kernel.org/stable/c/7847c4140e06f6e87229faae22cc38525334c156
- https://git.kernel.org/stable/c/e09299225d5ba3916c91ef70565f7d2187e4cca0
- https://git.kernel.org/stable/c/feae34c992eb7191862fb1594c704fbbf650fef8
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html