Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) verifier contains a flaw in how it validates kernel function (kfunc) arguments that specify buffer sizes. When processing read-only or read-write buffer size parameters, the verifier fails to reject oversized values, causing 64-bit values to be truncated to 32-bit when stored in memory size fields. An attacker with BPF program loading privileges could exploit this to bypass memory access bounds checks, potentially enabling unauthorized memory access or causing kernel memory corruption.
Technical details
The vulnerability exists in the BPF verifier's kfunc argument checking logic (kernel/bpf/verifier.c). When processing rdonly_buf_size or rdwr_buf_size arguments, the verifier copies a 64-bit register value (reg->var_off.value) into meta->r0_size without validating that the value fits within the u32 range. This u64 value is later assigned to the returned register's mem_size field (regs[BPF_REG_0].mem_size), which is only u32. A constant with upper 32 bits set gets silently truncated rather than rejected at load time, causing the verifier to record an incorrect memory bound (approximately 4 GiB). Subsequent memory access checks against that register use the wrong, truncated bound. The fix adds explicit validation to reject rdonly_buf_size/rdwr_buf_size values exceeding U32_MAX. Exploitation requires the ability to load BPF programs (typically available to CAP_BPF or CAP_SYS_ADMIN).
Affected products
- Linux Linux Kernel 5.8 and later (prior to patch)
Timeline
- 2026-09-17: disclosed
- 2026-07-09: patched: Upstream fix committed