HIGH Introduced in 6.7
bpf IterState Bypass
CVE-2026-90217
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.9HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Compare iterator types during state pruning An iterator stack slot can be MEM_RCU or PTR_UNTRUSTED. These states must not be equal, or the verifier can prune an unsafe path. Compare the pointer type for STACK_ITER slots.
02KernelScan AI Analysis
Risk summary
A flaw in the BPF verifier's state pruning logic allows an unsafe BPF program to pass verification, potentially granting arbitrary kernel memory read and write to a local attacker. Systems that allow unprivileged or containerized BPF program loading are at highest risk of container escape and full kernel compromise.
Vulnerability analysis
The BPF verifier's state pruning logic compares iterator stack slots to decide whether a verification path can be safely skipped, but it omits the pointer type from the comparison. An iterator slot can be in a trusted RCU-protected state or an untrusted state, and treating these as equivalent lets the verifier prune away a path that should be fully checked, accepting a program that performs unauthorized memory accesses. The fix adds the pointer type to the comparison so that slots with different types are no longer considered equal during pruning. The vulnerability is reachable locally through the BPF program loading interface, which requires CAP_BPF or CAP_SYS_ADMIN; on systems where unprivileged BPF is enabled, an unprivileged local user inside a user namespace can trigger it.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 6.7 | 7.2.6 | 6424b9cde9ed |
| mainline | 6.7 | 7.3-rc1 | 83608e303b95 |