Executive brief
A vulnerability was identified in the Linux kernel's BPF subsystem, which is used for high-performance networking and system monitoring. A flaw in how the system verifies certain program instructions could allow a local attacker to bypass security checks. This could lead to unauthorized access to sensitive system memory or a complete system takeover.
Technical details
A vulnerability exists in the Linux kernel BPF verifier's 'compute_insn_live_regs()' function. When processing 'gotox rX' (indirect jump) instructions, the verifier fails to properly mark the source register (rX) as used. This flaw in liveness tracking can lead to the verifier incorrectly pruning safety checks or miscalculating register states during program verification. A local attacker with the ability to load BPF programs could exploit this to bypass kernel memory protections. The issue has been resolved by ensuring the destination register is correctly marked as 'used' when the BPF_X source flag is present in jump instructions.
Affected products
- Linux Linux Kernel All versions prior to the fix in kernel/bpf/verifier.c
Timeline
- 2026-01-14: patched: Initial fix authored and committed to mainline.
- 2026-05-08: disclosed: CVE published.