Executive brief
The Linux kernel's eBPF (extended Berkeley Packet Filter) verifier contains a logic error in its Spectre v4 protection mechanism. The vulnerability could allow an attacker to craft a malicious eBPF program that bypasses speculative store bypass sanitization, potentially exposing sensitive kernel data through speculative execution side-channels.
Technical details
The vulnerability is a logic error in the check_stack_write_fixed_off() function in kernel/bpf/verifier.c. The function uses incorrect slot indexing when performing Spectre v4 sanitization pre-checks on stack writes. Specifically, the pre-check uses slot_type[i] while the actual write path uses slot_type[(slot - i) % BPF_REG_SIZE], causing a mismatch when checking whether bytes require sanitization. This allows a crafted eBPF program to bypass speculative store bypass mitigations for certain stack write patterns. Exploitation requires the ability to load and execute an eBPF program, which is typically restricted to privileged users. The fix corrects the slot index computation in the pre-check to match the write path logic.
Affected products
- Linux Linux kernel multiple versions (affected versions span from linux-2.6.11.y through linux-7.2.y based on stable tree references)
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched: Fix committed upstream (d1d53aa30ab3b5ae89161c9cc840b3f7489ad386) and backported to stable trees