Executive brief
The Linux kernel's eBPF (Berkeley Packet Filter) JIT compiler for x86-64 contains a memory handling flaw in the trampoline code that handles function calls with large (128-bit) arguments. When processing 128-bit scalar types, the kernel incorrectly calculates stack space requirements, causing the save_args() function to write beyond allocated stack memory. An attacker with the ability to load eBPF programs (typically requiring CAP_BPF and CAP_PERFMON capabilities) could exploit this to corrupt kernel memory, leading to privilege escalation or denial of service.
Technical details
The vulnerability is a stack buffer overflow in the eBPF x86-64 JIT trampoline code (arch/x86/net/bpf_jit_comp.c). The btf_distill_func_proto() function accepts function arguments up to 16 bytes (128-bit scalars like __int128), but the register allocation logic only allocated space for one register per argument, regardless of size. Since 128-bit arguments require two x86-64 registers, the register save area was under-allocated. The save_args() function would then overwrite adjacent stack slots, corrupting kernel memory. The fix computes the required register count from argument size for all arguments, not just struct types. Attack preconditions include the ability to load eBPF programs into the kernel, which is restricted to privileged users but may be available in container or specialized environments.
Affected products
- Linux Linux kernel before fix commit 814cba835ef648e0c5eb79505c96c0493b29eea6
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Upstream fix committed; backported to stable trees