Executive brief
A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, which is used for high-performance networking and system monitoring. The system's security checker failed to correctly recognize certain types of code jumps, potentially allowing malicious programs to bypass safety checks. This could lead to unauthorized data access or system instability, though it requires the attacker to already have local access to the system.
Technical details
A vulnerability exists in the Linux kernel BPF verifier's liveness analysis and Control Flow Graph (CFG) computation. The function `verifier.c:can_jump()` failed to include the `BPF_JSET` instruction (a bitwise AND conditional jump) as a valid jump type. Consequently, the verifier's `insn_successors()` function would miss potential execution paths, leading to incorrect register liveness marking and SCC computation. An attacker with local privileges to load BPF programs could potentially exploit this logic error to bypass verifier safety checks, leading to arbitrary memory access or local privilege escalation. The issue has been patched in several stable kernel branches including 6.15.10 and 6.16.1.
Affected products
- Linux Linux Kernel 6.15 to 6.15.10, 6.16 to 6.16.1
Timeline
- 2025-08-19: disclosed
- 2025-08-19: advisory
- 2025-08-15: patched