Linux kernel BPF verifier: missing Spectre v4 sanitization leaks kernel pointers to unprivileged BPF

Impact

The earlier Spectre v4 mitigation inserted an lfence after initializing a stack slot and after spilling a pointer, but not when a slot that already held a pointer was overwritten with a scalar. That second store can be bypassed speculatively, so a later load reads a value that is architecturally a scalar but speculatively a pointer, and the program can recover its bits one at a time through a branch-based cache side channel. The payoff for an attacker is kernel address disclosure - the frame pointer in the published case - which is the KASLR break that turns an otherwise unreachable memory-safety bug into a working exploit. This matters on a GPU node only where unprivileged BPF loading is reachable: a tenant with CAP_BPF or unprivileged_bpf_disabled turned off, or an observability sidecar that lets workloads submit programs.

Who can reach it

Local, and only for a principal that can load BPF programs - an unprivileged user if unprivileged BPF is enabled, otherwise a process holding CAP_BPF or CAP_SYS_ADMIN. A pod with no BPF access cannot reach this.

What to do

Update to a stable kernel containing the fix (scalars are now sanitized when they overwrite a slot that previously held a pointer) and reboot the node. Until then the practical mitigation is to keep unprivileged BPF disabled (kernel.unprivileged_bpf_disabled=1) and not to grant CAP_BPF to tenant workloads, which removes the attack path without a maintenance window. Stable commits are in the references; the advisory names no single fixed release.

References

Related entries

• Linux kernel scsi/ses: out-of-bounds desc_ptr accesses while parsing enclosure dataCVE-2023-53675 · Linux kernel scsi: ses (enclosure descriptor parsing)High
• Linux kernel arm64: negative length in IP checksum code causes out-of-bounds readCVE-2023-53726 · Linux kernel arm64 csum (do_csum negative length handling)High
• Linux kernel (drivers/gpu/drm/vmwgfx): A tenant that asks for a fence event on its DRM fd and then reads the fd backCVE-2024-36960 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel (drivers/iommu/iommufd): A tenant supplies an IOVA and user pointer whose alignment math overflows, soCVE-2024-47719 · Linux kernel (drivers/iommu/iommufd)High
• Linux kernel (ALSA usb-audio): Out-of-bounds read finding clock sourcesCVE-2024-53150 · Linux kernel (ALSA usb-audio)High
• VMware ESXi / Workstation / Fusion: Out-of-bounds read in HGFS leaks vmx process memory to the guestCVE-2025-22226 · VMware ESXi / Workstation / FusionHigh