Executive brief
The Linux kernel's eBPF subsystem failed to mask certain kernel pointer values when writing diagnostic logs of compiled eBPF programs. Under specific configurations where pointer leaks are blocked, sensitive kernel memory addresses could remain visible in system logs, potentially revealing information useful for kernel exploitation or bypassing address space layout randomization (ASLR).
Technical details
The vulnerability is a pointer leak in the eBPF verifier's diagnostic logging mechanism. The function `print_bpf_insn()` in `kernel/bpf/disasm.c` masks kernel pointer values in `ldimm64` (load 64-bit immediate) instructions when the `allow_ptr_leaks` flag is set to false, but the masking logic originally covered only `BPF_PSEUDO_MAP_FD` and `BPF_PSEUDO_MAP_VALUE` pseudo-source types. Three additional pseudo-source types—`BPF_PSEUDO_MAP_IDX`, `BPF_PSEUDO_MAP_IDX_VALUE`, and `BPF_PSEUDO_BTF_ID`—can also be resolved to actual kernel pointers before logging and were not masked, allowing kernel addresses to leak in verifier logs. The fix expands the pointer classification to include all five pseudo-source types so that masked addresses (0x0) are printed instead. No authentication or user interaction is required; this is a defensive information disclosure vulnerability affecting systems with eBPF enabled.
Affected products
- Linux Linux kernel Multiple versions (see kernel.org stable trees)
Timeline
- 2026-08-15: disclosed
- 2026-06-25: patched: Upstream fix committed; backported to stable series