bpf PseudoFunc Bypass

Vulnerability analysis

The BPF verifier accepts programs that load a reference to the main subprogram as a function pointer. When the program has only one subprogram, the JIT compilation step that should convert that placeholder into a real kernel address is skipped entirely. If the program passes the unresolved pointer to a helper that later invokes it as a callback, the kernel calls an attacker-influenced address in kernel context. The fix adds a check in the verifier that rejects any program trying to use the main subprogram as a callback target, blocking the unsafe program before it is loaded. The issue can be triggered locally through the BPF program-loading interface by any process with CAP_BPF, a capability that unprivileged users can acquire inside a user namespace on most default kernels.