Executive brief
The Linux kernel's eBPF (extended Berkeley Packet Filter) subsystem contains a type validation flaw in atomic load operations. An attacker could craft malicious eBPF programs that bypass security checks and cause type confusion in kernel memory accesses, potentially leading to unauthorized data access or privilege escalation on systems that allow unprivileged eBPF program loading.
Technical details
The vulnerability exists in the check_atomic_load() function, which validates eBPF atomic instructions. The function incorrectly checks the destination register type after the load overwrites the source register's type, allowing invalid pointer types (ctx, pkt, flow_keys, sock) to pass validation. Specifically, when a load-acquire instruction fetches into its own source register (dst_reg == src_reg), check_load_mem() overwrites the source pointer type before atomic_ptr_type_ok() can validate it. Since bpf_convert_ctx_accesses() does not rewrite atomic loads, the raw kernel object access remains, leaving type-confused registers (e.g., PTR_TO_SOCK_COMMON_OR_NULL) that bypass type checks. The fix moves source pointer type validation via atomic_ptr_type_ok() and check_reg_arg() before the load, mirroring the safer check_atomic_rmw() approach. The attack requires the ability to load eBPF programs, which may be unprivileged on many systems.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-17: disclosed