Linux bpf: sysctl write buffer allocated with kvzalloc but freed with kfree, corrupting memory

Impact

proc_sys_call_handler() allocates the temporary sysctl write buffer with kvzalloc(), which falls back to vmalloc for large writes, but the cgroup BPF sysctl filter freed the replacement buffer with kfree(). Freeing a vmalloc address through the slab path corrupts kernel memory; the reporter reproduced a page fault in kfree() under KASAN with fault injection while writing 8191 bytes to a sysctl from inside the target cgroup. Reaching it needs a BPF_CGROUP_SYSCTL program attached to the cgroup the writer lives in, which is a container-runtime and policy-agent pattern rather than something a bare tenant sets up - so the realistic exposure on a GPU fleet is a node whose runtime or security agent installs sysctl filters. The record describes memory corruption; it does not demonstrate a controlled privilege escalation.

Who can reach it

Local - a process in a cgroup that has a BPF sysctl filter attached, performing a large sysctl write. Attaching the filter itself requires privilege; the write does not.

What to do

Update to a stable kernel that frees the buffer with kvfree(). Until then, not attaching BPF_CGROUP_SYSCTL programs avoids the path entirely, which may be possible depending on your runtime and policy agent. The kernel fix needs each node drained and rebooted.

References

Related entries

• Linux keys: unpinned request_key_auth payload lets KEYCTL_INSTANTIATE race into a use-after-freeCVE-2026-63823 · Linux kernel keyring (request_key_auth payload refcounting)High
• Linux KEYS: miscalculated output buffer length overflows on keyctl asymmetric key operationsCVE-2026-63824 · Linux kernel keyring asymmetric key ops (keyctl_pkey_params_get_2)High
• Linux arm64: stale page-table entry left in the walk cache when a hugetlb PMD table is unsharedCVE-2026-63875 · Linux kernel arm64 TLB maintenance (tlb_flush on hugetlb PMD unshare)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-63881 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2026-63884 · Linux i915 GPU kernel driverHigh
• Linux kernel (net/xfrm): Cloning an IPTFS security association kmemdups the mode data, so the clone shares the originalCVE-2026-63911 · Linux kernel (net/xfrm)High