Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) subsystem contains a logic error in BTF (BPF Type Format) record field parsing that checks the wrong variable when validating resource spin lock offsets. This bug could allow incorrect validation of BPF data structure definitions, potentially leading to memory safety issues or verification bypass in BPF programs that use spin locks.
Technical details
A case statement in kernel/bpf/btf.c for handling BPF_RES_SPIN_LOCK resource types incorrectly checks the spin_lock_off variable instead of res_spin_lock_off when validating offsets. The vulnerability is a logic error (CWE-670: Always-Incorrect Control Flow Implementation) in the btf_parse_fields() function where a WARN_ON_ONCE() check uses the wrong field variable. No authentication or network access is required; the bug is triggered during BPF program verification. An attacker could craft a malicious BPF program that bypasses offset validation checks, potentially leading to memory corruption or verification bypass. The fix involves changing the checked variable from spin_lock_off to res_spin_lock_off in the validation condition.
Affected products
- Linux Linux kernel affected versions include stable kernels with BPF_RES_SPIN_LOCK support
Timeline
- 2026-09-17: disclosed