bpf IterState Bypass

Vulnerability analysis

The BPF verifier's state pruning logic compares iterator stack slots to decide whether a verification path can be safely skipped, but it omits the pointer type from the comparison. An iterator slot can be in a trusted RCU-protected state or an untrusted state, and treating these as equivalent lets the verifier prune away a path that should be fully checked, accepting a program that performs unauthorized memory accesses. The fix adds the pointer type to the comparison so that slots with different types are no longer considered equal during pruning. The vulnerability is reachable locally through the BPF program loading interface, which requires CAP_BPF or CAP_SYS_ADMIN; on systems where unprivileged BPF is enabled, an unprivileged local user inside a user namespace can trigger it.