Executive brief
A configuration error in the Linux kernel's BPF (Berkeley Packet Filter) subsystem could allow certain security checks to be bypassed. Specifically, a rename of a compiler setting caused code intended to verify the integrity of kernel functions to be accidentally omitted during the build process. This could potentially allow an attacker to exploit function pointer mismatches that would otherwise be blocked by Control-Flow Integrity (CFI) protections.
Technical details
A vulnerability in the Linux kernel's BPF implementation arises from the use of an obsolete configuration macro, CONFIG_CFI_CLANG, which was renamed to CONFIG_CFI. Because the code in kernel/bpf/btf.c relied on the old macro name, the logic intended to enforce btf_dtor_kfunc_t type matching via CFI was silently compiled out. This allows CFI failures for destructor kfuncs to trigger or be bypassed on systems where CFI should be active. The issue is resolved by updating the IS_ENABLED check to use the correct CONFIG_CFI macro.
Affected products
- Linux Linux 7.0 to 7.0.10, 7.1
Timeline
- 2026-03-12: other: Patch authored
- 2026-06-24: disclosed: CVE published