Executive brief
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem could allow for incorrect program execution. The BPF verifier, which ensures that custom scripts are safe to run, incorrectly optimized memory operations because it misunderstood how certain internal functions accessed data. This could lead to a situation where the system relies on outdated or incorrect information, potentially impacting the stability or security of the operating system.
Technical details
A vulnerability exists in the Linux kernel BPF verifier's handling of helper function prototypes. Following a refactor of helper access type tracking, the verifier relies on flags like MEM_RDONLY or MEM_WRITE to perform memory access optimizations. Several helpers using ARG_PTR_TO_MEM lacked these flags, leading the verifier to incorrectly assume buffer contents remained unchanged across helper calls. This allows the verifier to optimize away subsequent reads, resulting in the use of stale data. Additionally, bpf_get_stack_proto_raw_tp was incorrectly marked MEM_RDONLY despite performing writes. An attacker could potentially leverage these correctness issues to bypass security checks or cause unpredictable kernel behavior. The issue is resolved by correctly specifying memory access flags in the affected prototypes.
Affected products
- Linux Linux kernel Introduced in 37cce22dbd51; fixed in 802eef5afb18, aa3195928920, fdfe75161f6e
Timeline
- 2026-01-20: patched: Initial fix committed to mainline kernel
- 2026-05-27: advisory: CVE-2026-45903 published by NVD