Linux kernel BPF: BPF_PROG_QUERY writes the revision field past a short bpf_attr from userspace

Impact

BPF_PROG_QUERY unconditionally writes back query.revision even when userspace supplied a smaller bpf_attr - the 40-byte layout that predates the field - producing an out-of-bounds write into the caller's own memory. The fix propagates the user-supplied attribute size into the cgroup query handlers and skips the write when the buffer is too small. Practical impact on a GPU node is memory corruption in the querying process's address space, so the risk is concentrated where a privileged agent does the querying: cgroup-BPF-based CNI, runtime security tooling and container runtimes that enumerate attached programs. tcx and netkit query paths are not exposed, since revision existed in their bpf_attr from the first release.

Who can reach it

Local user able to call BPF_PROG_QUERY on cgroup attach types, which requires CAP_BPF or root in the relevant namespace. Not network reachable and not reachable from an unprivileged tenant pod without delegated BPF capabilities.

What to do

Pick up the stable-kernel update containing the referenced commits; the fix lands in the kernel, so each node needs a drain and reboot. Nothing can be toggled at runtime to disable the affected path other than withholding CAP_BPF from workloads. The record names only stable git commits, no distribution version.

References

Related entries

• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDCVE-2026-74446 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-74447 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel THP split: use-after-free on the inode when memory-failure splits a shmem huge pageCVE-2026-74482 · Linux kernel mm/huge_memory (__folio_split i_mmap_rwsem release order)High
• Linux kernel hugetlbfs: list corruption in reservation top-up can link a kernel-stack address into MM stateCVE-2026-74518 · Linux kernel hugetlbfs reservation map (allocate_file_region_entries)High
• Linux kernel (net/rds): Bind() on an RDS socket with a scoped IPv6 address looks up the interface under RCU, drops theCVE-2026-74563 · Linux kernel (net/rds)High
• Linux kernel ltc4282 hwmon driver: out-of-bounds read reading the VGPIO minimum alarm voltageCVE-2026-80696 · Linux kernel hwmon ltc4282 (VGPIO minimum alarm voltage read)High