Executive brief
A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, which is used for high-performance networking and system monitoring. The issue involves a failure to properly check for errors during the verification of certain program instructions. If exploited, this could potentially allow unstable or malicious code to bypass security checks, leading to system instability or unauthorized access.
Technical details
The vulnerability exists within the BPF verifier component of the Linux kernel (specifically in kernel/bpf/verifier.c). The root cause is a failure to check and propagate the return value of the visit_tailcall_insn() function within the visit_insn() loop. This function was introduced to manage stack liveness for tail calls, but by ignoring its error codes, the verifier may proceed as if a program is safe even when the tail call logic identifies a violation. An attacker with the ability to load BPF programs (typically requiring CAP_BPF or CAP_SYS_ADMIN) could potentially bypass verifier safety guarantees. The issue has been resolved by ensuring the return value is checked and returned to the caller.
Affected products
- Linux Linux 6.19, 7.0.10, 7.1
Timeline
- 2026-04-08: patched: Initial fix commit in Linux kernel tree.
- 2026-07-19: disclosed: CVE published to NVD.