Executive brief
A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) verifier, which is responsible for ensuring that user-submitted programs are safe to run. The verifier failed to correctly track relationships between certain data values, potentially allowing a malicious program to bypass security checks. This could lead to unauthorized system access or instability, though it typically requires the ability to load BPF programs on the host.
Technical details
A logic error in the BPF verifier's regsafe() function allowed for inconsistent ID mapping when comparing scalar registers carrying the BPF_ADD_CONST flag. Specifically, check_scalar_ids() mapped compound IDs (base ID combined with the BPF_ADD_CONST flag) without verifying that the underlying base IDs remained consistent with existing mappings in the idmap. This flaw could allow an attacker to construct two verifier states that appear equivalent but have different register dependencies, causing the verifier to incorrectly prune a state and permit unsafe program execution. The fix involves explicitly invoking check_ids() on the base IDs (with flag bits stripped) to ensure mapping consistency.
Affected products
- Linux Linux Kernel 6.11 to 6.12.91, 6.18.33, 7.0.10
Timeline
- 2026-04-11: other: Patch authored by Daniel Borkmann
- 2026-06-24: disclosed: CVE published