Executive brief
The Linux kernel's eBPF (extended Berkeley Packet Filter) subsystem, which powers container security policies and network packet filtering, contains a flaw in how it validates storage access across chained programs. An attacker with the ability to load eBPF programs could bypass security restrictions and access cgroup local storage that should not be accessible, potentially leading to privilege escalation or unauthorized access to sensitive data within containers.
Technical details
The vulnerability exists in the eBPF prog-array compatibility check (kernel/bpf/core.c) which validates cgroup storage cookies when handling tail calls between eBPF programs. The flaw treats a program with no cgroup storage as compatible with any stored storage cookie, allowing a storage-less program to bridge a tail call chain (A → B(no storage) → C(storage)). This violates the intended security model where cgroup local storage should follow the caller's context. The fix tightens the check to only accept a zero storage cookie if the program cannot perform tail calls itself (!aux->tail_call_reachable), allowing legitimate A → B patterns while rejecting the dangerous A → B → C bridge. The issue requires CAP_BPF or CAP_SYS_ADMIN capability to exploit, as those are needed to load eBPF programs.
Affected products
- Linux Linux kernel 5.0 and later
Timeline
- 2026-08-15: disclosed
- 2026-06-10: patched: Upstream commit 10627ddc0167aab5c1c390a10ef461e9937aba08