Executive brief
The Linux kernel's eBPF verifier contains a flaw in how it cleans up stack memory metadata during program validation. When pointer values are partially cleaned from the call stack, critical tracking information is lost, allowing malicious eBPF programs to bypass security checks. A local attacker with BPF loading privileges can exploit this to execute unintended operations or gain unauthorized access to kernel memory.
Technical details
The vulnerability exists in the __clean_func_state() function in kernel/bpf/verifier.c, which cleans dead stack slots in 4-byte halves during eBPF program verification. When the high half of a STACK_SPILL slot is dead but the low half remains live, the function incorrectly converts pointer spill slots to STACK_MISC/STACK_ZERO and clears the spilled_ptr metadata. This allows a subsequent 32-bit fill operation from the still-live half to bypass the normal non-scalar register-fill check (check_stack_read_fixed_off()) and be treated as an ordinary scalar stack read. The fix preserves non-scalar spill slots in their original state when only half is live, ensuring pointer spill metadata remains intact for proper verification. Attack vector is local; the attacker must load a malicious eBPF program to trigger the flaw.
Affected products
- Linux Linux Kernel All versions prior to fix
Timeline
- 2026-08-15: disclosed
- 2026-06-22: patched