HIGH Introduced in 2.6.12
bpf Subprog UAF
CVE-2026-98589
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject pkt arguments in mutating subprogs The verifier tracks changes in how PTR_TO_PACKET registers' bounds are modified across subprog boundaries. PTR_TO_PACKET registers are actually passed as PTR_TO_MEM, which is assumed valid for the entire call. This is not the case with packet memory, where a pskb_* call may invalidate its memory region. Reject BPF code that passes PTR_TO_PACKET pointers to subprogs that may mutate a packet. We cannot pass the pointer as a true PTR_TO_PACKET because we would also need to somehow pass the PTR_TO_PACKET_META or PTR_TO_PACKET_END to the subprog. Since we cannot avoid representing the pointer in the subprog as PTR_TO_MEM, only permit it if the subprog is guaranteed not to mutate the packet.
02KernelScan AI Analysis
Risk summary
A local attacker with CAP_BPF (or root) can load a malicious BPF program that passes packet pointers to subprograms capable of mutating packet data. The verifier incorrectly allows this, creating a use-after-free primitive when pskb_* calls reallocate the packet buffer. This can lead to kernel memory corruption, privilege escalation, and container escape.
Vulnerability analysis
The BPF verifier tracks bounds for packet pointers (PTR_TO_PACKET) but represents them as generic PTR_TO_MEM when passed as arguments to global functions (subprograms). PTR_TO_MEM is assumed valid for the entire call, yet packet memory can be invalidated by pskb_* helpers that reallocate the skb. The verifier failed to check whether the called subprogram might mutate packet data, allowing a program to pass verification while holding a stale pointer to freed packet memory. The fix adds a check that rejects any BPF program passing a packet pointer to a subprogram marked as potentially changing packet data (sub->changes_pkt_data). The vulnerability is reachable by any local user able to load BPF programs — typically requiring CAP_BPF or root, though unprivileged users can trigger it if unprivileged BPF is enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 2.6.12 | 7.2.9 | 0b6b2bb9b90a |
| mainline | 2.6.12 | 7.3 | a6c1edfbe240 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |