HIGH Introduced in 6.1
bpf KfuncBufSize Bypass
CVE-2026-93125
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max check_kfunc_args() detects a kfunc argument named rdonly_buf_size or rdwr_buf_size and stores reg->var_off.value into meta->r0_size, a u64, and does not bound it. check_kfunc_call() later copies that value into the returned register's mem_size field: meta->r0_size = reg->var_off.value; ... regs[BPF_REG_0].mem_size = meta.r0_size; regs[BPF_REG_0].mem_size is u32. A constant whose upper 32 bits are set gets truncated instead of causing a load-time rejection, so the verifier records a PTR_TO_MEM register with an approximately 4 GiB mem_size for whatever allocation the kfunc returned. A later access check against that register uses the truncated, wrong bound. Reject rdonly_buf_size/rdwr_buf_size values that exceed U32_MAX at the point meta->r0_size is set.
02KernelScan AI Analysis
Risk summary
A BPF verifier bug allows a crafted BPF program to bypass bounds checks on memory returned by a kfunc, enabling out-of-bounds reads and writes in kernel memory. An attacker with CAP_BPF (or unprivileged BPF if enabled) can load a program that exploits the truncation to achieve arbitrary kernel memory access, leading to privilege escalation or kernel crash. Systems running untrusted BPF programs or granting BPF capabilities to containers are most at risk.
Vulnerability analysis
The BPF verifier accepts an oversized size argument for certain kernel functions without checking whether it fits the 32-bit limit used to track memory bounds. Because the value is silently truncated, the verifier can be tricked into thinking a returned memory buffer is far larger than it really is. Subsequent access checks rely on this incorrect bound, allowing a loaded BPF program to read and write beyond the actual buffer into arbitrary kernel memory. The fix rejects any size argument larger than the 32-bit maximum at program load time, before the wrong bound is ever recorded. The flaw is reachable through the BPF program-loading syscall, which requires CAP_BPF on most systems, or no privileges if unprivileged BPF is enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.1 | 6.12.114 | b6ac0b573204 |
| 6.18 | 6.1 | 6.18.57 | 93a20b14f862 |
| 6.6 | 6.1 | 6.6.160 | 2147065d3a4e |
| 7.2 | 6.1 | 7.2.6 | 56a3846830ac |
| mainline | 6.1 | 7.3 | 2aaf67f0516f |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |