Linux kernel BPF: wrong bpf_xdp_store_bytes argument type lets the helper read uninitialized memory

Impact

bpf_xdp_store_bytes declared its source buffer as ARG_PTR_TO_UNINIT_MEM, which both made the verifier demand write access to a read-only map value (breaking legitimate XDP programs that source bytes from a BPF_F_RDONLY_PROG map, as hit in Cilium) and allowed the helper to read from memory the program never initialized. The security-relevant half is the second: stale kernel stack or map bytes can be written into packets on the wire. Exposure is limited to whoever may load XDP programs, which on a GPU node is the CNI and the node's networking agents, not a tenant pod. No crash or privilege escalation is described.

Who can reach it

Local, requires the privilege to load XDP/BPF programs on the node (CAP_BPF plus CAP_NET_ADMIN), so realistically a node agent or an operator with a custom datapath program. Not reachable by an unprivileged tenant unless BPF load has been delegated.

What to do

Update to a stable kernel carrying the corrected prototype (five stable commits linked, matching bpf_skb_store_bytes) and reboot the node; folding it into the regular kernel rollout is appropriate. No separate mitigation exists, though not delegating BPF program loading to tenants removes the exposure.

References

Related entries

• Linux kernel RT scheduler: self-IPI storm in rto_next_cpu() can hard-lock a CPUCVE-2026-45919 · Linux kernel sched/rt (rto_next_cpu() RT push-IPI loop)Medium
• Linux kernel SUNRPC auth_gss: gss_auth reference leaked when gss_alloc_msg allocation failsCVE-2026-45964 · Linux kernel SUNRPC auth_gss (gss_alloc_msg kref leak on kstrdup_const failure)Medium
• Linux kernel KVM nSVM: interrupt shadow not synced to cached vmcb12, nested vCPU can hangCVE-2026-45987 · Linux kernel KVM nSVM (vmcb12 interrupt shadow sync)Medium
• Linux kernel KVM: DEBUGCTL and LBR MSRs missing from save/restore, guest branch state lostCVE-2026-46014 · Linux kernel KVM SVM/VMX (DEBUGCTL and LBR MSR save/restore)Medium
• Linux kernel algif_aead: async AEAD requests share the socket IV buffer, IV handling can be inconsistentCVE-2026-46028 · Linux kernel crypto algif_aead (AF_ALG async AEAD IV handling)Medium
• Linux kernel KVM nSVM: failed host CR3 restore on nested #VMEXIT keeps running L1 with corrupted stateCVE-2026-46032 · Linux kernel KVM nSVM (nested_svm_vmexit host CR3 restore)Medium