Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) subsystem contains a logic error in how it validates type information when processing user-supplied data. A malicious user can craft specially formatted type data that bypasses field validation checks, potentially triggering internal warnings and allowing the creation of invalid kernel data structures that should have been rejected.
Technical details
The vulnerability is a logic error in the BPF Type Format (BTF) field parsing code, specifically in the btf_find_struct_field() function. The function initializes a fresh "seen mask" (a state variable tracking which fields have already been observed) on each recursive descent into nested structures. This allows duplicate special fields at different nesting levels to bypass uniqueness validation. An attacker with CAP_BPF or root capability can supply a crafted BTF type definition that triggers a WARN_ON_ONCE() invariant check in btf_parse_fields() before kernel security checks validate map creation permissions. The fix involves initializing the seen mask once in btf_find_field() and passing the same pointer through all recursive traversals to maintain consistent uniqueness state across the entire type hierarchy.
Affected products
- Linux Linux kernel All versions with BPF subsystem (approximately kernel 5.0+)
Timeline
- 2026-09-17: disclosed
- 2026-07-19: patched: Upstream fix committed