Executive brief
The Linux kernel's BPF (eBPF) subsystem contains a flaw in queue and stack map operations where uninitialized kernel memory could be exposed to unprivileged eBPF programs when lock acquisition fails. An attacker with permission to run eBPF programs could read sensitive kernel memory contents, compromising system confidentiality.
Technical details
The vulnerability is an information disclosure in kernel/bpf/queue_stack_maps.c affecting the __queue_map_get() and __stack_map_get() helper functions. When a spin lock acquisition fails (returns -EBUSY due to contention), the output buffer passed by the eBPF program is not cleared before the error is returned, allowing the program to observe uninitialized kernel stack contents. The verifier expects these helpers to always initialize the output buffer, making this a violation of that contract. The fix adds memset(value, 0, qs->map.value_size) calls before returning -EBUSY to ensure the buffer is always cleared. eBPF programs require CAP_BPF or CAP_SYS_ADMIN to load, but the exposure affects kernel memory that could contain sensitive data.
Affected products
- Linux Linux Kernel affected versions not explicitly specified; patch available
Timeline
- 2026-09-17: disclosed: CVE published on NVD
- 2026-07-19: patched: Fix authored by Kumar Kartikeya Dwivedi
- 2026-09-14: other: Patch integrated into stable kernel tree by Greg Kroah-Hartman