Executive brief
The Linux kernel's eBPF subsystem contains a vulnerability in BTF (BPF Type Format) struct field access validation. When walking dynamically allocated objects, the kernel failed to enforce memory bounds before allowing flexible array relaxations, permitting out-of-bounds memory access. An attacker with unprivileged BPF program loading capability can exploit this to read or write memory beyond allocated object bounds, potentially leading to information disclosure or privilege escalation.
Technical details
This is a bounds-check bypass vulnerability in the kernel's BPF verifier, specifically in the `btf_struct_walk()` and `btf_struct_ids_match()` functions. The root cause is that BTF struct walking logic relaxes struct-size checks to accommodate trailing flexible arrays, but this relaxation was being applied even to MEM_ALLOC objects (dynamically allocated kernel structures). MEM_ALLOC objects are allocated with a fixed static size and should not permit out-of-bounds access. The fix adds a `walk_flex_arrays` parameter to prevent flexible array relaxation when verifying MEM_ALLOC pointers. Exploitation requires the ability to load BPF programs (typically restricted to privileged users, but available in many container environments). The vulnerability affects kernel versions with the BPF object allocation feature (introduced in commit 958cf2e273f0) through versions before the fix (committed 2026-07-07).
Affected products
- Linux Linux kernel 5.1 through 6.x before 2026-07-07 patch
Timeline
- 2026-09-17: disclosed: CVE-2026-93148 disclosed
- 2026-07-07: patched: Upstream fix committed (commit 9c9ee0324c774490ae953162aaaf4561d222bd93)
- 2026-09-14: patched: Backported to stable kernels