Executive brief
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem could allow a local attacker to improperly modify kernel function arguments. By abusing the way certain tracing programs interact, an attacker could change the behavior of the operating system's core functions. This could lead to unauthorized system changes or instability, though it typically requires the ability to load BPF programs.
Technical details
A vulnerability exists in the Linux kernel BPF subsystem where 'freplace' programs can be used to bypass restrictions on 'kprobe' programs. While 'uprobe' programs are permitted to modify 'struct pt_regs', 'kprobe' programs generally are not. Because uprobes are internally treated as a KPROBE type, an attacker can attach an 'freplace' program to a 'kprobe' program that is itself attached to a kernel function. This chain allows the 'freplace' program to modify the registers (such as the first argument) of the target kernel function. The fix involves disallowing the attachment of 'freplace' programs to 'kprobe' programs if they have mismatched 'kprobe_write_ctx' values. This issue affects kernel versions starting from 6.18 and has been patched in stable releases.
Affected products
- Linux Linux 6.18, 7.0.10, 7.1
Timeline
- 2026-03-31: other: Patch submitted by developer
- 2026-06-24: disclosed: CVE published to NVD