Executive brief
A vulnerability was identified in the Linux kernel's BPF subsystem, which is used for high-performance networking and system monitoring. The flaw occurs when the system analyzes program behavior, potentially allowing a local attacker to cause a system crash or gain unauthorized access to sensitive information. This could impact the overall stability and security of the operating system.
Technical details
The vulnerability is a stack-based out-of-bounds access within the 'widen_imprecise_scalars()' function in 'kernel/bpf/verifier.c'. The root cause is a failure to account for differing allocated stack depths between a current state and its ancestor in the explored states tree. When the verifier compares states for iterator convergence, it may attempt to access stack slots in a state with a smaller allocated stack than its ancestor. A local attacker can exploit this during BPF program verification to trigger memory corruption or information leakage. The issue has been resolved by ensuring the verifier only iterates over the minimum number of stack slots common to both states.
Affected products
- Linux Linux Kernel 6.6.15 to 6.6.117, 6.7 to 6.12.59, 6.17 to 6.17.9
Timeline
- 2025-11-13: patched: Initial fix authored by Eduard Zingerman
- 2025-12-16: disclosed: CVE published