Executive brief
A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, which is used for high-performance networking and system monitoring. A flaw in how the system tracks relationships between data registers could allow a specially crafted program to bypass safety checks. This could lead to a system crash (denial of service) or potentially allow unauthorized actions by bypassing the kernel's internal security verifier.
Technical details
A vulnerability exists in the Linux kernel BPF verifier's `sync_linked_regs()` function. When propagating bounds between linked registers, the verifier incorrectly overwrote the register ID of the target register with a constant flag (BPF_ADD_CONST) from the source register. This caused the verifier to lose track of the relationship between registers (breaking the link). Consequently, subsequent bound updates to one register were not propagated to its linked counterparts. An attacker can exploit this to pass a BPF program that the verifier incorrectly deems safe, leading to out-of-bounds access or division-by-zero errors at runtime. The fix involves explicitly preserving the register ID, offset, and sub-register definition flags during the synchronization process.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026-03-04
Timeline
- 2026-01-15: other: Patch authored
- 2026-03-04: patched: Patch committed to stable tree
- 2026-05-27: advisory: NVD advisory published