Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) subsystem contains a type-checking mismatch in how task work callbacks are invoked. This causes kernel Control Flow Integrity (kCFI) validation to fail, potentially leading to system instability or security policy violations on kernels with CFI enforcement enabled.
Technical details
A CFI (Control Flow Integrity) mismatch exists in the BPF task work scheduling code (kernel/bpf/helpers.c). BPF subprograms use the bpf_callback_t ABI (5 arguments, all u64), but the task work callback invocation was using a three-argument function pointer type, causing kCFI runtime checks to reject the call. The fix stores and invokes the callback using the correct bpf_callback_t signature, converting arguments to u64 format with zero-padding as needed. This is a post-fix for commit 38aa7003e369 which introduced BPF task work scheduling kfuncs. The vulnerability affects any system with kCFI enabled and requires no network access or user action—it manifests as a control flow violation at callback invocation time.
Affected products
- Linux Linux kernel 5.0 and later versions containing BPF task work scheduling (from commit 38aa7003e369)
Timeline
- 2026-09-17: disclosed
- 2026-07-24: patched: Commit 2805abd089576799b15092949420e3f8ba97fabd merged