Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) subsystem handles dynamic instrumentation of kernel functions via trampolines. A defect allows programs to attach to functions that return values larger than 8 bytes (such as 16-byte __int128 types). When these oversized return values pass through certain trampoline types (fexit, fmod_ret, fsession, or struct_ops), only the first 8 bytes are preserved, corrupting the remaining data seen by the actual caller and leading to silent data loss or logical errors in dependent code.
Technical details
The vulnerability lies in the BPF trampoline's inability to preserve return values larger than 8 bytes. The btf_distill_func_proto() function, which constructs the function signature model for trampolines, previously accepted 16-byte __int128 return types without restriction. However, the x86-64 register-based calling convention stores large return values in register pairs (RAX/RDX), and the BPF trampoline infrastructure only saves and restores the first 8 bytes (RAX/R0). For attach types that read the return value (fexit, fmod_ret, fsession, and struct_ops variants), this causes the second half to be silently lost. The fix adds validation in bpf_check_attach_target(), bpf_check_attach_btf_id_multi(), and bpf_struct_ops_desc_init() to reject >8 byte return values for these attachment types, while leaving fentry/fentry_multi unaffected (they execute before the return).
Affected products
- Linux Linux kernel 5.0 and later (original BPF trampoline introduction through fix date)
Timeline
- 2026-09-17: disclosed
- 2026-08-01: patched: upstream kernel commit c48796aa6c392cde93946e5d5a9a1f1b1cf72feb
- 2026-07-28: other: patch authored