Executive brief
The Linux kernel's eBPF (extended Berkeley Packet Filter) virtual machine contains a flaw where load-acquire instructions bypass fault protection checks that are normally applied to pointer dereferences. An attacker could craft a malicious eBPF program that causes an unhandled kernel fault, leading to a kernel panic and denial of service of the system.
Technical details
The vulnerability exists in the eBPF verifier's handling of BPF_LOAD_ACQ (load-acquire) instructions. Unlike regular BPF_LDX instructions, which are rewritten to BPF_PROBE_MEM and produce an exception table entry, BPF_LOAD_ACQ instructions are not similarly transformed. This allows dereferencing untrusted pointer types (PTR_TO_BTF_ID, PTR_TO_BTF_ID with MEM_UNTRUSTED, PTR_TO_MEM with MEM_RDONLY | PTR_UNTRUSTED) without fault protection. When a NULL or invalid pointer is dereferenced via load-acquire, the fault cannot be caught by the exception handler, causing a kernel panic instead of graceful handling. The fix rejects BPF_LOAD_ACQ operations on these untrusted pointer types, while permitting them on PTR_TRUSTED pointers where the guarantee exists. eBPF programs are loaded via the bpf() syscall, which typically requires CAP_BPF or CAP_SYS_ADMIN capability.
Affected products
- Linux Linux kernel prior to fix commit (kernel version range not specified in advisory)
Timeline
- 2026-09-17: disclosed