Executive brief
A technical issue was identified in the Linux kernel's BPF subsystem, which is used for high-performance networking and security filtering. The system's 'verifier'—a security component that ensures programs are safe to run—incorrectly handled certain memory operations, potentially causing legitimate networking programs to fail or allowing programs to read from uninitialized memory. This has been resolved in recent kernel updates to ensure proper data handling and system stability.
Technical details
A vulnerability in the Linux kernel's BPF subsystem was identified where the bpf_xdp_store_bytes helper function used an incorrect argument prototype. Specifically, the third argument was typed as ARG_PTR_TO_UNINIT_MEM, which implies a write operation (MEM_WRITE). When a BPF program attempted to use a read-only map (BPF_F_RDONLY_PROG) as the source for this helper, the verifier would reject the program because it perceived a write attempt to a read-only memory region. Additionally, the ARG_PTR_TO_UNINIT_MEM type could allow the helper to read from uninitialized memory. The fix changes the argument type to ARG_PTR_TO_MEM | MEM_RDONLY, correctly reflecting that the helper reads from the provided buffer. This affects various stable kernel branches including 6.1.y, 6.6.y, and 6.12.y.
Affected products
- Linux Linux kernel 6.1, 6.6, 6.12, 6.13, 6.14
Timeline
- 2026-01-31: disclosed: Initial patch submitted by Paul Chaignon
- 2026-05-27: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/0db169a91381a473b7974021d1c02f8da72c5775
- https://git.kernel.org/stable/c/57f7f6a0ad04a65c8a7a067b2f56cbbf2aec9e52
- https://git.kernel.org/stable/c/6557f1565d779851c4db9c488c49c05a47a6e72f
- https://git.kernel.org/stable/c/d7b87adeb0eb539b9b824b101bb14fb01e41240b
- https://git.kernel.org/stable/c/ddc34a1b85505c919026ddc82fafdada9a160b15
- https://git.kernel.org/stable/c/ffb5d1c5e3933b947fc7303ad68bf0c536d0c85e