HIGH Introduced in 6.9
bpf ArenaFree OOB
CVE-2026-93045
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bpf_arena_free_pages() accepts scalar arena addresses. The runtime masks the address to the low 32 bits and reconstructs a full user address from the arena base before returning the range to the arena free tree. When the scalar value is below the low 32 bits of the arena base, full_uaddr falls below user_vm_start. The existing upper-end clipping then turns this into an out-of-range free-tree offset. A later allocation can reuse that offset and return an address below the arena mapping. Reject such frees before computing the clipped range.
02KernelScan AI Analysis
Risk summary
A BPF program calling the arena free-pages helper with a carefully chosen scalar address can corrupt the arena's free tree, causing a subsequent allocation to return a pointer to kernel memory outside the arena. This gives the BPF program arbitrary kernel read/write capability, enabling privilege escalation or kernel crash. Any local user who can load BPF programs (CAP_BPF, or unprivileged BPF if enabled) can trigger this.
Vulnerability analysis
The BPF arena subsystem lets programs allocate and free shared memory using kernel helpers. The free helper takes a scalar address, keeps only the low 32 bits, and rebuilds a full address by adding the arena base. When the scalar is smaller than the low 32 bits of the base, the rebuilt address ends up below the arena's start. The existing size-limit check only catches values that are too large, not too small, so this underflow becomes an invalid entry in the arena's tracking structure. A later allocation can then hand back that same invalid address, giving the BPF program a pointer outside the arena that can read or write kernel memory. The fix rejects free requests that would produce an address below the arena before any size calculations. Any local user who can load BPF programs can reach this, which requires CAP_BPF or unprivileged BPF if the system allows it.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.9 | 6.18.52 | a968dffa5ab3 |
| mainline | 6.9 | 7.3-rc1 | b5a71cb2db6d |
| 7.2 | 6.9 | 7.2.6 | 8a0863565603 |
| 6.12 | 6.9 | 6.12.110 | 90453eaf8f14 |
| cip/6.12 | 6.9 | 6.12.111-cip32 | 90453eaf8f14 |