Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) subsystem contains a logic error that allows kernel warnings when certain socket option functions are called from UNIX domain socket hooks without proper locking. This can be exploited by privileged users running BPF programs to trigger kernel warnings and potentially crash the system or reveal kernel state information.
Technical details
The vulnerability is a logic error in the BPF subsystem where bpf_setsockopt() and bpf_getsockopt() helper functions require the socket lock to be held (via sock_owned_by_me() assertions), but BPF_CGROUP_UNIX_GETPEERNAME and BPF_CGROUP_UNIX_GETSOCKNAME hooks execute BPF programs without acquiring this lock. An attacker with CAP_SYS_ADMIN privileges can attach a BPF program to these hooks and call the affected helpers, triggering the assertion warnings. The fix removes these two hook types from the allowed list for bpf_setsockopt() and bpf_getsockopt() in the sock_addr_func_proto() function in net/core/filter.c, disallowing their use in these contexts.
Affected products
- Linux Linux kernel All versions with BPF UNIX socket cgroup hooks (from kernel commit 859051dd165e onwards)
Timeline
- 2026-09-17: disclosed
- 2026-08-17: patched: Upstream fix merged