Linux kernel BPF: trampoline flag overwrite corrupts a tail-call-reachable program's patch site

Impact

The verifier assigned tr->flags unconditionally instead of OR-ing into it, so attaching a second fexit program to the same tail-call-reachable target dropped BPF_TRAMP_F_CALL_ORIG. When the first link is then released, the trampoline fails to restore the target program's original instruction, leaving a patched text site behind and triggering a WARNING in bpf_tracing_link_release(). The result is a corrupted executable text patch in a live BPF program - a correctness and stability hazard on nodes where observability or networking agents attach and detach tracing programs continuously, which is normal on a managed GPU fleet.

Who can reach it

Local and privileged: requires the ability to load and attach fexit tracing programs (CAP_BPF/CAP_SYS_ADMIN) against a tail-call-reachable target, and an attach/detach ordering. No unauthenticated or network path.

What to do

Take the stable kernel that updates tr->flags with |= under the trampoline mutex (backported across stable branches; see the linked commits), then drain and reboot the node. No vendor mitigation is published; limiting who may attach tracing programs reduces how often the ordering occurs but does not fix it.

References

Related entries

• Linux kernel BPF verifier: u64 kfunc buffer size truncated into a u32 mem_size boundCVE-2026-93125 · Linux kernel BPF verifier (rdonly_buf_size/rdwr_buf_size kfunc arguments)High
• Linux kernel BPF verifier: writes through untrusted BTF pointers bypass the read-only policyCVE-2026-93144 · Linux kernel BPF verifier (check_ptr_to_btf_access, PTR_UNTRUSTED writes)High
• Linux kernel BPF verifier: flexible-array relaxation allows BTF access past a MEM_ALLOC objectCVE-2026-93148 · Linux kernel BPF verifier (BTF struct walk of PTR_TO_BTF_ID | MEM_ALLOC objects)High
• Linux vhost-scsi: stale response iovecs after a memory-table change write into unrelated memoryCVE-2026-93782 · Linux kernel vhost-scsi (VHOST_SET_MEM_TABLE vs in-flight command iovecs)High
• Linux kernel perf: addr_filter_ranges freed without RCU grace period, leaving a use-after-freeCVE-2026-93817 · Linux kernel perf events (event::addr_filter_ranges RCU lifetime)High
• sudo: TZ from the calling user shifts NOTBEFORE/NOTAFTER windows, reviving expired rulesCVE-2026-96512 · sudo (NOTBEFORE/NOTAFTER sudoers time restrictions)High