Executive brief
A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, which is used for high-performance networking and system monitoring. Under certain configurations, the system could attempt to use a non-existent internal function, potentially leading to a system crash or allowing an attacker to gain unauthorized control over the system. This issue primarily affects local users and could impact system stability and data security.
Technical details
A vulnerability exists in the Linux kernel BPF verifier's get_helper_proto function. The root cause is a missing validation check for the helper function pointer, which can be NULL if specific kernel configuration options are disabled. An attacker with local access could potentially trigger a NULL pointer dereference or other memory safety issues by invoking BPF programs that reference these invalid helper functions. The fix introduces a check in get_helper_proto to ensure the function pointer is valid and uses BPF_PTR_POISON for the tail_call helper to prevent misuse. Patches have been released for various stable kernel branches including 6.12.50 and 6.16.10.
Affected products
- Linux Linux Kernel 5.8 to 6.16.10
Timeline
- 2025-07-16: other: Issue reported by kernel test robot
- 2025-10-02: patched: Fix committed to stable kernel trees
- 2025-10-15: disclosed: CVE published