Executive brief
A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, which is used for high-performance network filtering and system monitoring. The BPF verifier, a security component that ensures BPF programs are safe to run, failed to correctly analyze certain error paths when loading packet data. This flaw could potentially allow a local attacker to crash the system or cause unpredictable behavior by bypassing intended security checks.
Technical details
A vulnerability exists in the Linux kernel BPF verifier's handling of ld_abs and ld_ind instructions within subprograms. These instructions, used for legacy packet data access, contain a hidden 'abnormal' exit path (r0=0 + exit) that is triggered if a load fails. Previously, the verifier only simulated the success path, failing to validate the state of the program during an abnormal return. This lack of path exploration could lead to incorrect verification of BPF subprograms. The fix ensures the verifier simulates both success and failure paths, similar to how tail calls are handled. This issue affects kernels from version 5.10 (where subprog support for these instructions was introduced) up to the fixed versions in the 7.x branch.
Affected products
- Linux Linux Kernel 5.10 to 7.1
Timeline
- 2026-04-08: disclosed: Initial patch authored by Daniel Borkmann
- 2026-06-24: advisory: NVD publication date