Executive brief
The Linux kernel's eBPF (extended Berkeley Packet Filter) subsystem enforces read-only policies on certain memory pointers to prevent unauthorized data modification. A flaw in the BTF (BPF Type Format) access validation allowed eBPF programs to bypass this protection and perform unauthorized writes to restricted memory regions. An attacker with the ability to load eBPF programs could exploit this to modify kernel data structures or leak sensitive information.
Technical details
The vulnerability exists in the check_ptr_to_btf_access() function in kernel/bpf/verifier.c, where program-type btf_struct_access callbacks were permitted to validate write operations before the default BTF access path could enforce the read-only policy. Specifically, untrusted BTF pointers marked with the PTR_UNTRUSTED flag (created by helpers like bpf_rdonly_cast()) were not properly restricted from write access in all code paths. An attacker with eBPF program loading capability (typically requiring CAP_BPF or CAP_SYS_ADMIN) could craft a malicious eBPF program to write to memory regions intended to be read-only, potentially compromising kernel security. The fix adds an explicit check to reject non-read accesses through PTR_UNTRUSTED pointers at the common entry point before callback branching.
Affected products
- Linux Linux kernel multiple versions prior to patch (fixes commit 282de143ead9)
Timeline
- 2026-09-17: disclosed
- 2026-07-08: patched: Fix committed upstream; backported to stable trees