Executive brief
A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, which is used for high-performance networking and system monitoring. The issue allows certain programs to bypass safety checks, potentially leading to a system crash (kernel panic). This could be used by a local attacker to cause a denial-of-service, impacting the availability of the affected server or device.
Technical details
A vulnerability exists in the Linux kernel BPF verifier's check_mem_access() function. The verifier uses base_type() to match PTR_TO_BUF, which inadvertently strips the PTR_MAYBE_NULL flag. This allows BPF programs to directly dereference pointers that might be NULL, such as map iterator keys and values during stop callbacks, without performing a mandatory null check. An attacker with the ability to load and execute BPF programs could trigger a kernel NULL pointer dereference, resulting in a denial-of-service (kernel panic). The fix introduces a type_may_be_null() guard to ensure nullable PTR_TO_BUF pointers are properly handled by the verifier.
Affected products
- Linux Linux Kernel All versions prior to the April 2026 patches
Timeline
- 2026-04-02: other: Patch submitted by Qi Tang
- 2026-04-18: patched: Committed to stable tree by Greg Kroah-Hartman
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/10bc4a4dcded509c5d5c67d497900c3922c604cd
- https://git.kernel.org/stable/c/21a10c06ffae24cb01fd174a7ab7736001d2ea56
- https://git.kernel.org/stable/c/4f6c99dc0420f1a3d671c1b8ab8a7ac84d9cba09
- https://git.kernel.org/stable/c/63276547debc4d8a73eefb2c5273b2a905c961b0
- https://git.kernel.org/stable/c/70abd9d118da2f56beb4ec22e3a29becae373535
- https://git.kernel.org/stable/c/8755066f7bd0f4ac46a29d1708c7b20894539252
- https://git.kernel.org/stable/c/b0db1accbc7395657c2b79db59fa9fae0d6656f3