Executive brief
The Linux kernel's Berkeley Packet Filter (BPF) subsystem has a memory safety issue in how it handles map value recycling, particularly in NMI (non-maskable interrupt) contexts used by tracing programs. Attackers with BPF program loading privileges could trigger unsafe field destruction operations in sensitive execution contexts, potentially leading to kernel crashes or information disclosure. This affects systems running tracing tools or custom BPF programs.
Technical details
The vulnerability exists in the BPF map update and delete paths, which call bpf_obj_free_fields() to destroy field values during replacement or recycling. This function performs full field destruction including unsafe operations (kptr destructors, uptr unpinning, graph root destruction) that cannot safely execute from NMI context. The root cause is context-agnostic field cleanup that does not account for the execution environment. The fix introduces bpf_obj_cancel_fields() which performs only NMI-safe cleanup (timer, workqueue, task_work fields) during value recycling, deferring full destruction to the final cleanup path. Attack preconditions include BPF program loading capability (typically available to privileged users or in containerized environments with BPF LSM). An attacker can trigger crashes or memory corruption by crafting BPF programs that exercise the vulnerable recycling paths.
Affected products
- Linux Linux kernel all versions prior to fix
Timeline
- 2026-08-15: disclosed