Executive brief
The Linux kernel's eBPF (extended Berkeley Packet Filter) subsystem manages network packet filtering and system tracing. A flaw in the trampoline flag management causes corruption when multiple tracing hooks are attached to the same program, leading to invalid machine code generation and kernel warnings. This could result in denial of service or unpredictable kernel behavior.
Technical details
The vulnerability is a race condition in the BPF verifier's handling of trampoline flags, specifically in the interaction between multiple fexit (function exit) probes attached to tail-call-reachable programs. The root cause is a blind flag assignment (`tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX`) that overwrites prior flags instead of merging them using bitwise OR. When the first fexit is detached, the missing `BPF_TRAMP_F_CALL_ORIG` flag causes incorrect restoration of the target program's instruction (jmp instead of call), triggering a kernel WARNING in bpf_tracing_link_release(). The fix replaces direct assignment with a locked flag-merge operation (`bpf_trampoline_set_flags()`) that properly preserves existing flags and prevents concurrent corruption.
Affected products
- Linux Linux kernel All versions with BPF trampoline support (approximately 5.3+)
Timeline
- 2026-09-17: disclosed
- 2026-07-24: patched: Upstream fix commit 61aaa8782bec59ecffd22e030f54ef9351bcabf9