Executive brief
A vulnerability in the Linux kernel's BPF subsystem could allow a local attacker to leak sensitive kernel memory addresses or cause a system crash. The issue occurs when specific network monitoring programs (sock_ops) handle internal data incorrectly, potentially leading to unauthorized access to system information. This could impact the confidentiality of kernel data or the overall stability of the operating system.
Technical details
A vulnerability exists in the Linux kernel's BPF subsystem within the `sock_ops` context access logic. When a BPF program accesses context fields where the destination and source registers are the same (`dst_reg == src_reg`), the `SOCK_OPS_GET_SK()` and `SOCK_OPS_GET_FIELD()` macros fail to zero out the destination register in certain code paths (specifically the `!fullsock` or `!locked_tcp_sock` paths). This results in the destination register retaining a stale context pointer. In `SOCK_OPS_GET_SK`, this can lead to a stack-out-of-bounds read when the bogus pointer is used in helpers like `bpf_skc_to_tcp6_sock()`. In `SOCK_OPS_GET_FIELD`, the stale pointer is treated as a scalar value, resulting in a kernel pointer leak. The issue has been patched by ensuring the destination register is correctly zeroed.
Affected products
- Linux Linux 5.4.61 to 5.5, 5.7.18 to 5.8, 5.8.4 to 5.9, 5.9 and later
Timeline
- 2026-04-12: patched: Patch committed to Linux stable tree
- 2026-06-24: advisory: CVE published