HIGH Introduced in 5.19
bpf copy_user_syms Bypass
CVE-2026-80865
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Add missing access_ok call to copy_user_syms As reported by sashiko we use __get_user without prior access_ok call on the user space pointer. Adding the missing call for the whole pointer array. Plus removing the err check in the error path, because it's not needed and also we can return -ENOMEM directly from the first kvmalloc_array fail path. [1] https://lore.kernel.org/bpf/20260611115503.AC16D1F00893@smtp.kernel.org/
02KernelScan AI Analysis
Risk summary
A missing access_ok validation in the BPF kprobe multi link symbol resolution path allows a local user with BPF privileges to pass an invalid user-space pointer to __get_user, potentially causing kernel memory corruption or information disclosure. The issue is reachable through BPF program attachment operations requiring CAP_BPF.
Vulnerability analysis
The BPF subsystem's symbol copy routine for kprobe multi link attachments failed to validate a user-supplied pointer array before dereferencing it, allowing an attacker to pass a pointer that bypasses normal user-space access checks and trigger unintended kernel memory access. The fix adds the missing validation on the entire pointer array before any dereference occurs, and cleans up the error handling path. This code path is reachable locally by a user with BPF loading privileges (CAP_BPF), which on most distributions requires at least low privileges due to unprivileged BPF being disabled by default.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 5.19 | 6.1.178 | a67f7f9647cb |
| 6.12 | 5.19 | 6.12.97 | 128391b57e09 |
| 6.18 | 5.19 | 6.18.40 | 0b6252afcd19 |
| 6.6 | 5.19 | 6.6.145 | 8b719cef5ac3 |
| 7.1 | 5.19 | 7.1.5 | 28ce7bcf8a29 |
| mainline | 5.19 | 7.2 | d5dc200c3a3f |
| cip/6.1 | 5.19 | 6.1.182-cip59 | a67f7f9647cb |
| cip/6.1-rt | 5.19 | 6.1.182-cip59-rt31 | a67f7f9647cb |
| cip/6.12 | 5.19 | 6.12.101-cip29 | 128391b57e09 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.101-cip29 |
| cip/6.1 | Fixed in 6.1.182-cip59 |
| cip/6.1-rt | Fixed in 6.1.182-cip59-rt31 |