bpf MemAlloc OOB

Vulnerability analysis

The BPF verifier's logic for checking struct access sizes treats structs with a trailing flexible array as potentially larger than their static definition. This is correct for ordinary kernel data structures, but objects allocated through bpf_obj_new have exactly the static size — there is no extra memory for a flexible array. A BPF program referencing such an object could therefore read or write past the allocation into adjacent kernel heap memory, leading to corruption or information leaks. The fix ensures that for these specifically allocated objects, the verifier does not apply the flexible-array relaxation and rejects accesses that extend past the object's declared size. Loading a BPF program that triggers this requires CAP_BPF; on systems where user namespaces grant that capability to unprivileged users, a local attacker can exploit the flaw.