Linux kernel BPF verifier: stale register bounds let an LSM-hook retval load bypass memory-safety checks

Impact

When the verifier narrows an LSM hook return value it called __mark_reg_s32_range(), which intersects with the register's existing bounds instead of replacing them. A register carrying stale bounds from a prior instruction can end up with a range narrower than reality, so the verifier believes it knows an exact value that differs from what is loaded at runtime. That verifier/runtime mismatch is the classic route to defeating BPF memory-safety checks and reading or writing kernel memory from a loaded program - in practice host root from whoever can load the program. On a GPU fleet this matters wherever BPF program loading is reachable by anything other than the node's administrators: observability agents, CNI dataplanes, and any pod granted CAP_BPF.

Who can reach it

Local actor able to load a BPF program that performs a context load of an LSM hook return value - root, CAP_BPF/CAP_SYS_ADMIN, or a container granted those capabilities. Not reachable without BPF load privileges, and unreachable on kernels built without BPF LSM.

What to do

Update to a stable kernel with the mark_reg_unknown() reset in the is_retval path (four stable commits linked) and reboot each node; a verifier change ships in the kernel image. In the meantime, the exposure is governed by who may load BPF: denying CAP_BPF and CAP_SYS_ADMIN to tenant pods closes it without maintenance. The record carries no vendor advisory with fixed version strings.

References

Related entries

• Linux kernel (net/xfrm): The rtnetlink changelink path for xfrm interfaces checked CAP_NET_ADMIN only against theCVE-2026-72136 · Linux kernel (net/xfrm)High
• Linux kernel (arch/x86/kvm): When KVM failed to program the interrupt remapping table for irq bypass, it left aCVE-2026-72283 · Linux kernel (arch/x86/kvm)High
• Linux kernel xen/pvcalls: malicious backend req_id drives an out-of-bounds write in the PV frontendCVE-2026-72380 · Linux kernel xen/pvcalls frontend (unbounded backend req_id indexing rsp[])High
• Linux kernel BPF: conntrack kfuncs write opts->error outside the verifier-checked rangeCVE-2026-72423 · Linux kernel BPF conntrack kfuncs (opts__sz bounds on opts->error)High
• Linux kernel (drivers/iommu): Every peer-to-peer segment in a scatter-gather list inherits the length of the firstCVE-2026-74277 · Linux kernel (drivers/iommu)High
• Linux kernel (drivers/iommu/iommufd): Iommufd tears down the page-tracking state behind a dma-buf backed IOAS mappingCVE-2026-74328 · Linux kernel (drivers/iommu/iommufd)High