HIGH Introduced in 6.15
bpf CpumaskPopulate Bypass
CVE-2026-93112
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Require a BPF cpumask for bpf_cpumask_populate() bpf_cpumask_populate() writes to its destination with bitmap_copy(), but the destination is typed as struct cpumask *. That allows the verifier to accept borrowed cpumask pointers returned by read-only kfuncs, such as scx_bpf_get_online_cpumask(), as a writable destination. Make the destination a struct bpf_cpumask * so populate follows the same ownership rule as the other mutating cpumask kfuncs. Query kfuncs continue to accept const struct cpumask * inputs.
02KernelScan AI Analysis
Risk summary
A BPF program can overwrite kernel-internal read-only cpumask structures through the populate helper, corrupting kernel state with attacker-controlled data. This is reachable locally by any process able to load BPF programs (CAP_BPF, or unprivileged BPF if enabled). The corruption can lead to kernel memory compromise, privilege escalation, or denial of service.
Vulnerability analysis
The BPF cpumask populate helper accepted a generic cpumask pointer as its write destination, which allowed the verifier to pass through borrowed, read-only cpumask pointers returned by query kfuncs. A BPF program could then use the populate helper to overwrite kernel-internal cpumask data structures that should only be readable, corrupting kernel state with attacker-controlled bits. The fix tightens the destination parameter to require an owned BPF cpumask, enforcing the same ownership rule as other mutating cpumask helpers so the verifier rejects borrowed pointers. This is reachable locally by any process that can load BPF programs, which requires CAP_BPF (or unprivileged BPF if enabled on the system).
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.15 | 6.18.52 | 0cfc9348a045 |
| 7.2 | 6.15 | 7.2.6 | b7e2a5c6519a |
| mainline | 6.15 | 7.3 | 8740156ad33b |