Linux kernel bpf: copy_user_syms calls __get_user on a userspace pointer array with no access_ok check

Impact

The kprobe_multi attach path read a user-supplied pointer array with __get_user() without first calling access_ok() on it. On architectures where the user and kernel address ranges are not separated in hardware, a missing access_ok() is what stops a caller-supplied kernel address from being dereferenced as if it were user memory; the fix adds the check for the whole array. The record gives no CVSS, no CWE and no exploitation detail, so the honest read is a missing-validation fix in a privileged BPF attach path rather than a demonstrated read primitive. Reaching it requires the privilege to attach multi-kprobes, which on a properly configured node is not something a tenant workload has - it matters most where CAP_BPF or CAP_SYS_ADMIN has been handed to observability agents or to privileged containers.

Who can reach it

Local caller privileged enough to attach a kprobe_multi BPF program - CAP_BPF plus tracing privileges, in practice a privileged container or a node agent. Not reachable by an unprivileged tenant pod under default policy.

What to do

Take the stable commits listed in the record; no fixed release is named there. Rollout is an ordinary kernel update and node reboot. In the meantime the exposure is bounded by who holds BPF tracing privileges on the node, so reviewing which DaemonSets run with CAP_BPF is a reasonable interim control.

References

Related entries

• Linux kernel vmwgfx: integer overflow in the shader offset bound check lets an unbounded offset reach host SVGA commandsCVE-2026-80887 · Linux kernel vmwgfx (vmw_shader_define shader size+offset bound check)Unscored
• Linux kernel vmwgfx: dma_buf reference leaked on foreign prime import pins the exporter's memory indefinitelyCVE-2026-80888 · Linux kernel vmwgfx (ttm_prime_fd_to_handle foreign-fd prime import)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical