Database/Kernel, userspace & hypervisor
Linux kernel BPF verifier: atomic-fetch precision gap lets equivalent-looking states be pruned
Impact
backtrack_insn treated a BPF_STX with BPF_ATOMIC|BPF_FETCH as if the source register were input only, when it is also a destination receiving the old memory value. Precision never propagates to the stack slot, so the slot is not marked precise and the verifier's path pruning can call two states equivalent that actually differ. A program that should have been rejected gets accepted, which is the standard route to arbitrary kernel memory access from verified BPF. Reaching it requires the ability to load BPF programs, so on a GPU node the exposure is tenants given privileged pods or CAP_BPF for eBPF observability sidecars, not ordinary workloads. NVD rates it 7.8, local only.
Who can reach it
A local user able to load eBPF programs: CAP_BPF or CAP_SYS_ADMIN on the host or in a privileged container, or any local user if kernel.unprivileged_bpf_disabled is 0. No remote path.
What to do
Take a stable kernel containing the linked fix and reboot the node, draining GPU workloads first - there is no live-patch path for verifier logic. As an interim mitigation set kernel.unprivileged_bpf_disabled=1 and stop granting CAP_BPF or CAP_SYS_ADMIN to tenant pods; that removes the precondition entirely for multi-tenant nodes.
References
Related entries
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-43206 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
- Linux kernel (drivers/pci): The PCI slot-lock failure path releases a lock the caller never took, which at best warnsCVE-2026-43211 · Linux kernel (drivers/pci)High
- Linux kernel (net/rds): When pinning user pages for a zerocopy RDS send fails, the pages are released but theCVE-2026-43494 · Linux kernel (net/rds)High
- Linux kernel (net/rds): A zerocopy RDS send that fails after pinning user pages but before the message reaches theCVE-2026-43502 · Linux kernel (net/rds)High
- Linux kernel BPF: negative CO-RE accessor index causes an out-of-bounds read and deterministic kernel crashCVE-2026-45839 · Linux kernel BPF verifier (bpf_core_parse_spec CO-RE accessor parsing)High
- Linux kernel (drivers/iommu/intel): VT-d publishes the address of a freshly allocated PASID table into the PASIDCVE-2026-45862 · Linux kernel (drivers/iommu/intel)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.