Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) arena allocator contains a flaw in its memory freeing logic that allows specially-crafted operations to cause memory allocations to return addresses outside the intended arena boundaries. This could enable an attacker to read or write kernel memory outside the designated arena region, potentially compromising system integrity and enabling privilege escalation or data theft.
Technical details
The vulnerability exists in the bpf_arena_free_pages() function in kernel/bpf/arena.c. The function accepts scalar arena addresses, masks them to 32 bits, and reconstructs a full user-space address. When a free request contains an address value below the low 32 bits of the arena base, the reconstructed full_uaddr falls below user_vm_start. The existing upper-end clipping logic then converts this into an out-of-range offset in the arena's free tree. A subsequent allocation can reuse this offset and return an address below the arena mapping, breaking arena isolation. The fix adds a bounds check rejecting frees where full_uaddr is below user_vm_start before computing the clipped range. The vulnerability is reachable by unprivileged users who can load and run BPF programs, though exploitation requires knowledge of arena internals.
Affected products
- Linux Linux kernel versions containing bpf_arena (introduced in Linux 6.8+)
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-09-14: patched: Fix committed to stable kernel tree (upstream commit b5a71cb2db6d84ac0042549dcec266b18429d41e)
- 2026-07-17: other: Patch authored by Yiyang Chen