Linux kernel BPF verifier: load-acquire into its own source register yields pointer type confusion

Impact

check_atomic_load() runs check_load_mem() before atomic_ptr_type_ok(). When a load-acquire targets its own source register, the load overwrites the source register's type, so the later pointer-type check no longer sees the original pointer and fails to reject ctx, pkt, flow_keys and sock sources. Because bpf_convert_ctx_accesses() does not rewrite atomic loads, the raw access to the underlying kernel object survives into the loaded program: a load-acquire of __sk_buff->sk leaves the register typed PTR_TO_SOCK_COMMON_OR_NULL while holding unconverted struct sk_buff bytes. Past the NULL check that is pointer type confusion inside the kernel, not merely a kernel-memory leak - a credible local privilege-escalation primitive on any node where tenants or sidecars can load BPF programs, which on a Kubernetes GPU fleet includes CNI and observability agents.

Who can reach it

Local: any context able to load a BPF program with a BPF_ATOMIC load-acquire - CAP_BPF/CAP_SYS_ADMIN, or an unprivileged path where the fleet permits it. Authentication to the node is required; no remote vector.

What to do

Update to a stable kernel carrying the listed commits and reboot the node (drain first on GPU hosts - this is a verifier fix, not live-patchable in general). Until then, restrict who can call bpf() : keep unprivileged BPF disabled (kernel.unprivileged_bpf_disabled=1) and do not grant CAP_BPF or CAP_SYS_ADMIN to tenant workloads. No fixed distribution release is named in the record.

References

Related entries

• Linux kernel BPF verifier: kptrs stay valid after the final spin unlock ends RCU protectionCVE-2026-90317 · Linux kernel BPF verifier (RCU pointer validity after final bpf_spin_unlock)High
• Linux kernel bpf x86: trampoline under-allocates the save area for __int128 argumentsCVE-2026-90358 · Linux kernel BPF x86 JIT (trampoline register save area for 128-bit arguments)High
• Linux kernel IOMMU DMA: allocation failure not detected in the non-blocking non-coherent pathCVE-2026-90388 · Linux kernel iommu/dma (atomic pool allocation failure check in the non-coherent path)High
• Linux kernel BPF: unprotected link->prog read races bpf_link_update into a use-after-freeCVE-2026-90392 · Linux kernel BPF link info (bpf_link_show_fdinfo / bpf_link_get_info_by_fd prog access)High
• Linux kernel RDMA/rxe: use-after-free when ODP memory-region registration failsCVE-2026-90423 · Linux kernel RDMA/rxe (soft-RoCE, on-demand paging MR init error path)High
• Linux vhost-scsi: stale response iovecs after a memory-table change write into unrelated memoryCVE-2026-93782 · Linux kernel vhost-scsi (VHOST_SET_MEM_TABLE vs in-flight command iovecs)High