Executive brief
The Linux kernel's eBPF virtual machine enforces program exclusivity by binding certain maps to specific programs. An attacker can bypass this enforcement by inserting an exclusive map into a non-exclusive outer map, allowing unrelated programs to read and modify data that should be restricted, potentially leading to privilege escalation or data corruption on systems running vulnerable kernel versions.
Technical details
The vulnerability exists in the eBPF map-in-map subsystem (kernel/bpf/map_in_map.c). Maps created with excl_prog_hash are supposed to be bound to a single program; the kernel checks program compatibility via check_map_prog_compatibility() only for directly referenced maps. However, maps accessed indirectly through a map-of-maps bypass this check and bpf_map_meta_equal() does not validate excl_prog_sha, allowing an exclusive map to be nested inside a non-exclusive outer map. An attacker can then retrieve and mutate the exclusive map's contents through the outer map using an unrelated program, defeating the intended exclusivity guarantee. The fix adds explicit rejection checks in bpf_map_meta_alloc() and bpf_map_fd_get_ptr() to prevent exclusive maps from being used as inner maps.
Affected products
- Linux Linux kernel prior to fix commit 9a3c3c49c333760c8944dadacbe114c1884546ef
Timeline
- 2026-08-15: disclosed
- 2026-06-01: patched: Fix commit 9a3c3c49c333760c8944dadacbe114c1884546ef by Daniel Borkmann