HIGH Introduced in 6.8
bpf UntrustedPtr Bypass
CVE-2026-98037
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject untrusted allocated-object pointers When the final RCU read-side critical section ends, a local kptr is demoted to PTR_UNTRUSTED but retains MEM_ALLOC. The pointer may be NULL or may refer to an object whose lifetime is no longer protected. type_is_ptr_alloc_obj() nevertheless recognizes any PTR_TO_BTF_ID with MEM_ALLOC as a live allocated object. In particular, a refcount-only local kptr never carries NON_OWN_REF, so it still passes the bpf_refcount_acquire() argument check after RCU protection ends. The kfunc can then dereference NULL or stale memory. Make type_is_ptr_alloc_obj() reject PTR_UNTRUSTED pointers. Since type_is_non_owning_ref() is based on the same predicate, graph kfunc arguments obey the same live-object requirement. Fault-protected reads of the demoted pointer remain valid: writes are already rejected, and read fixups use bpf_may_fault_on_deref() rather than this predicate. [ kkd: Rewrote commit log ]
02KernelScan AI Analysis
Risk summary
A BPF verifier logic error allows programs to pass pointers that have been demoted to untrusted status (potentially NULL or pointing to freed memory) to kernel functions that dereference them. This can cause kernel crashes or use-after-free conditions exploitable for privilege escalation. Any local user who can load BPF programs (requiring CAP_BPF, or no special privileges if unprivileged BPF is enabled) can trigger this.
Vulnerability analysis
The BPF verifier incorrectly treats pointers demoted to untrusted status after an RCU read-side critical section ends as still-valid allocated objects. These demoted pointers may be NULL or may reference memory whose lifetime is no longer protected, yet the verifier permits them to be passed to kernel functions such as refcount acquisition that dereference the pointer, leading to NULL dereferences or use-after-free access. The fix makes the verifier reject untrusted pointers when checking for live allocated objects, so demoted pointers can no longer be used as arguments to kfuncs that expect a valid object reference. This is reachable locally by any user who can load BPF programs, which requires CAP_BPF on most systems (or no special privileges if unprivileged BPF is enabled).
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.8 | 6.12.111 | 092c2874dc1b |
| 6.18 | 6.8 | 6.18.53 | 135d542b97fa |
| 7.2 | 6.8 | 7.2.7 | 6b1f786ad85a |
| mainline | 6.8 | 7.3-rc2 | 7441ee827664 |
| cip/6.12 | 6.8 | 6.12.111-cip32 | 092c2874dc1b |