Linux kernel (eBPF verifier): Incorrect verifier pruning marks unsafe paths as safe

Impact

Incorrect verifier pruning marks unsafe paths as safe - arbitrary kernel read/write from BPF

Who can reach it

Any tenant process in a container where BPF is reachable

What to do

Livepatchable; otherwise drain + reboot. kernel.unprivileged_bpf_disabled=1; audit any tenant-facing eBPF observability feature

References

Related entries

• Linux kernel (eBPF verifier): eBPF ALU32 bitwise-op bounds tracking flawCVE-2021-3490 · Linux kernel (eBPF verifier)High
• Linux kernel (eBPF verifier): kernel/bpf/verifier.c mishandles pointer types - unprivileged BPF to local rootCVE-2022-23222 · Linux kernel (eBPF verifier)Medium
• Linux kernel SMC-R (fallback path, DECLINE message leaking into the application stream): Silent data corruption, whichCVE-2023-52775 · Linux kernel SMC-R (fallback path, DECLINE message leaking into the application stream)High
• QEMU (virtio): DMA reentrancy leads to double free across virtio devices - guest-to-host code execution in QEMUCVE-2024-3446 · QEMU (virtio)High
• Linux kernel (net/tls): A non-DATA record already copied out of the pending list could be merged with a second recordCVE-2024-58239 · Linux kernel (net/tls)High
• Intel ice driver (Ethernet 800 Series, Linux kernel mode): A missing check for an exceptional condition in theCVE-2025-20093 · Intel ice driver (Ethernet 800 Series, Linux kernel mode)High