Linux kernel BPF verifier: error from visit_tailcall_insn is not propagated

Impact

The BPF verifier's stack-liveness handling for tail calls called visit_tailcall_insn() without checking its return value, so an error condition during verification was swallowed instead of rejecting the program. A verifier that continues past an internal error is a load-bearing security boundary behaving unpredictably, which is why NVD scores it high; the commit message itself describes only the missing error check, so treat the concrete exploitability as unestablished. Exposure on a GPU node depends entirely on who can load BPF programs: with unprivileged BPF disabled (the default on current distributions) this is reachable only by root or a CAP_BPF holder, which includes privileged observability and CNI agents. Where tenants or sidecars have been granted CAP_BPF, it is a path from that capability into the verifier.

Who can reach it

Local. Requires the ability to load a BPF program with tail calls - in practice root, CAP_BPF/CAP_SYS_ADMIN, or a privileged agent container. Not reachable from the network and not reachable by an unprivileged tenant on a kernel with unprivileged BPF disabled.

What to do

Pick up the stable fix (commits 6bd96e40f31d / 945816e63c86) in your distribution kernel, then reboot each node - a kernel BPF change cannot be hot-patched here, so it is a drain-and-reboot per node and should ride an existing maintenance window unless you grant CAP_BPF broadly. Interim mitigation: confirm kernel.unprivileged_bpf_disabled=1 and audit which workloads hold CAP_BPF.

References

Related entries

• Linux kernel sockmap: bpf_msg_push_data mis-advances split fragment offset, corrupting scatterlist layoutCVE-2026-63926 · Linux kernel bpf sockmap (bpf_msg_push_data fragment offset)High
• Linux kernel arm_ffa: unvalidated notification layout drives out-of-bounds read of the shared RX bufferCVE-2026-64081 · Linux kernel arm_ffa (Arm FF-A framework notification parsing)High
• Linux kernel (arch/x86/kvm): A nested guest can put an out-of-range virtual-processor ID into an enlightened VMCS andCVE-2026-64247 · Linux kernel (arch/x86/kvm)High
• Linux kernel sockmap: integer overflow in bpf_msg_push_data allocation leads to out-of-bounds memcpyCVE-2026-64548 · Linux kernel bpf sockmap (bpf_msg_push_data copy+len integer overflow)High
• Linux kernel virtio-net: loose length check in receive_big() lets a malicious backend write past the frag arrayCVE-2026-64552 · Linux kernel virtio-net (receive_big() length validation)High
• Linux kernel sockmap: 32-bit wrap in bpf_msg_pop_data bounds check runs the pop loop off the scatterlistCVE-2026-74256 · Linux kernel bpf sockmap (bpf_msg_pop_data bounds check overflow)High