Executive brief
A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, which is used for high-performance networking and system monitoring. A logic error in how the kernel calculates memory addresses for certain instruction arrays could lead to incorrect program execution or system instability. This issue primarily affects system reliability and could potentially be leveraged by a local attacker to bypass security boundaries.
Technical details
A vulnerability exists in the Linux kernel's BPF implementation within the `map_direct_value_addr()` function of the instruction array map. The function incorrectly adds an offset to the resulting address, which is subsequently added again by the `resolve_pseudo_ldimm64()` function. This double-offset calculation results in an incorrect memory address being returned for non-zero offsets. An attacker with the ability to load and execute BPF programs could potentially exploit this to cause memory corruption or unexpected kernel behavior. The issue has been resolved by removing the redundant offset addition in `kernel/bpf/bpf_insn_array.c`.
Affected products
- Linux Linux Kernel All versions supporting indirect jumps in BPF via insn array
Timeline
- 2026-01-11: disclosed: Initial patch submitted by Anton Protopopov
- 2026-05-27: advisory: CVE-2026-45967 published in NVD