Linux BPF: BTF repeated-field count overflow allows an out-of-bounds write on BPF_BTF_LOAD

Impact

btf_parse_struct_metas() walks user-supplied BTF during BPF_BTF_LOAD, and btf_repeat_fields() expands array elements into a fixed BTF_FIELDS_MAX scratch array. The remaining-capacity arithmetic was done in u32 and could wrap, so a crafted BTF blob passes the check and the following memcpy() writes past the end of the array. That is a controlled kernel heap out-of-bounds write reachable from a single syscall, which is the classic route from a container with BPF rights to root on the host. On a GPU node this matters more than usual: observability agents, eBPF-based network policy and CI runners load BTF as a matter of course, and a compromised one of those on a multi-tenant node reaches every other tenant's memory on the box.

Who can reach it

Local caller of bpf(BPF_BTF_LOAD): CAP_BPF in the init user namespace, or any local user if kernel.unprivileged_bpf_disabled is 0. No remote path. A pod granted CAP_BPF or running privileged is in the same position as a local root user here.

What to do

Take the stable kernel update and reboot each node - there is no way to patch the BTF verifier live. Interim mitigation that costs nothing: set kernel.unprivileged_bpf_disabled=1 and drop CAP_BPF/CAP_SYS_ADMIN from workload pods, which removes the syscall from tenant reach even on an unpatched kernel. The record names four stable commits and no fixed release version.

References

Related entries

• Linux mm: shrinker_info teardown races with expansion, giving a double free of memcg shrinker mapsCVE-2026-64418 · Linux kernel memcg shrinker_info (alloc/teardown race with expand_shrinker_info)High
• Linux kernel BPF TCP iterator: double socket release on batch realloc failure panics the nodeCVE-2026-64575 · Linux kernel BPF TCP iterator (bpf_iter_tcp_batch)High
• Linux kernel (net/xfrm): Setting a per-socket IPsec policy reset the socket's destination cache non-atomically whileCVE-2026-64581 · Linux kernel (net/xfrm)High
• Linux kernel iomap: zero-length write range underflows into an out-of-bounds bitmap_set()CVE-2026-68145 · Linux kernel iomap (ifs_set_range_dirty / ifs_set_range_uptodate)High
• Linux kernel libceph: use-after-free reading the monmap debugfs file during client teardownCVE-2026-68153 · Linux kernel libceph (per-client debugfs files vs client teardown)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-68257 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High