HIGH Introduced in 6.2
bpf UntrustedPtr Bypass
CVE-2026-93144
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject writes through untrusted BTF pointers check_ptr_to_btf_access() lets program-type btf_struct_access callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy for untrusted BTF pointers created by helpers such as bpf_rdonly_cast(). Reject non-read accesses through PTR_UNTRUSTED BTF pointers at the common entry point, before the callback branch to handle all cases.
02KernelScan AI Analysis
Risk summary
The BPF verifier allows write operations through untrusted BTF pointers that should be read-only, giving a BPF program the ability to corrupt kernel memory. Any local user who can load BPF programs (typically requiring CAP_BPF, obtainable in a user namespace) can exploit this to escalate privileges or escape containers. Products that run untrusted BPF workloads or allow unprivileged BPF program loading are at highest risk.
Vulnerability analysis
The BPF verifier mistakenly allows write access through pointers that are supposed to be read-only. A specialized verifier path was approving writes before the default read-only check could reject them, so a malicious BPF program could modify kernel memory through a pointer intended only for reading. The fix blocks all write attempts through these untrusted pointers at the earliest shared check, before any specialized validation can occur. A local user who can load BPF programs can reach this flaw; on many systems this requires a capability that may be obtainable inside a user namespace.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.2 | 6.12.114 | c4dc883447ae |
| 6.18 | 6.2 | 6.18.57 | 644cf4e77c27 |
| 6.6 | 6.2 | 6.6.160 | 56f92fecd804 |
| 7.2 | 6.2 | 7.2.6 | 19d5566b84ca |
| mainline | 6.2 | 7.3 | ac65c710cc64 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |