Executive brief
The Linux kernel's eBPF subsystem improperly handles memory padding in per-CPU map lookups, potentially exposing uninitialized heap data to user-space applications. When applications query eBPF maps with unaligned value sizes, stale kernel memory from adjacent allocations may be leaked, risking exposure of sensitive kernel information.
Technical details
The vulnerability exists in the eBPF per-CPU map value copying logic. The copy_map_value_long() function in include/linux/bpf.h passes only map->value_size (the declared map value size) to bpf_obj_memcpy(), but per-CPU map elements in the kernel are actually stored with round_up(map->value_size, 8) bytes to maintain 8-byte alignment. When maps contain special fields, the copying logic skips tail padding bytes between map->value_size and the rounded-up size. Since temporary UAPI lookup buffers are allocated without __GFP_ZERO, these uncopied padding bytes retain stale heap contents. This affects both LOOKUP_ELEM and bpf_iter operations on per-CPU maps. The fix ensures round_up(map->value_size, 8) is passed to copy the entire per-CPU slot including padding.
Affected products
- Linux Linux kernel 5.0 and later (affected by the original bug introduced in kernel with commit 448325199f57)
Timeline
- 2026-09-17: disclosed: CVE published
- 2026-06-24: patched: Fix committed upstream (commit 7cf9cd98cf6f0df3befc167ca6b54c07014d71de)