Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) subsystem is missing a bounds check when reading user-supplied symbol data. An attacker with local access could exploit this to read or modify kernel memory, potentially leading to privilege escalation or denial of service.
Technical details
The vulnerability exists in the copy_user_syms() function in kernel/trace/bpf_trace.c, which calls __get_user() on a user-space pointer without first validating that the pointer is safe to access via access_ok(). This is a missing input validation bug in BPF kprobe multi-link symbol resolution. An unprivileged local attacker can trigger the vulnerable code path by loading a malicious eBPF program via the bpf() syscall. The fix adds the missing access_ok() check before dereferencing the user-space pointer array, immediately returning -EFAULT if validation fails. Patches have been committed to stable kernel branches.
Affected products
- Linux Linux kernel multiple versions across 2.6.11 through 7.2
Timeline
- 2026-09-04: disclosed: CVE-2026-80865 published
- 2026-07-24: patched: Fix committed to stable kernel branches