bpf Fastcall Bypass

Vulnerability analysis

The BPF verifier's fastcall optimization removes unnecessary register spill and fill instructions around helper calls to produce more efficient code. The pattern matching logic failed to account for cases where a jump instruction lands in the middle of a matched spill-call-fill sequence. When such a jump exists, the optimizer could remove spill/fill pairs that the jumped-to code path depends on, causing the rewritten program to use stale or incorrect register values. Since the verifier validates the original program but executes the rewritten one, this mismatch means the verifier's safety checks no longer apply to the actual executed code, potentially allowing a BPF program to access kernel memory it should not. The fix records which instructions are jump targets during control-flow graph construction and refuses to extend the optimization pattern past such instructions. The vulnerability is reachable by any process that can load BPF programs, which on systems with unprivileged BPF enabled includes unprivileged local users and containers.