Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) verifier contains a memory leak in error-handling code paths. When the verifier encounters certain allocation failures during the validation of BPF programs, it fails to properly release previously allocated memory structures, potentially leading to kernel memory exhaustion over time with repeated BPF program loading attempts.
Technical details
The vulnerability is a resource leak in kernel/bpf/verifier.c within the bpf_check() function. When env->insn_aux_data is successfully allocated but a subsequent allocation of env->succ fails, the error path jumps directly to err_free_env label, bypassing the vfree(env->insn_aux_data) cleanup code. The fix moves the vfree(env->insn_aux_data) call into the err_free_env error-handling block to ensure consistent memory release across all exit paths. This is a local kernel memory management issue triggered by BPF program verification failures, affecting kernel memory available to all processes.
Affected products
- Linux Linux kernel multiple versions (patch available since 2026-06-25)
Timeline
- 2026-06-24: other: Fix committed by KaFai Wan
- 2026-06-25: patched: Merged to mainline by Alexei Starovoitov
- 2026-08-15: disclosed