Linux kernel BPF verifier: u64 kfunc buffer size truncated into a u32 mem_size bound

Impact

check_kfunc_args() stored an unbounded u64 constant into meta->r0_size, which check_kfunc_call() then copied into the returned register's u32 mem_size field. A constant with its upper 32 bits set was silently truncated instead of rejected at load time, so the verifier accepted a PTR_TO_MEM register carrying a bound of roughly 4 GiB over whatever the kfunc actually allocated. Every later access check against that register used the wrong bound, giving out-of-bounds kernel read and write from a loaded program. On a GPU node this matters wherever BPF loading is reachable from inside the fleet - node-level observability agents, CNI dataplanes, or any pod granted CAP_BPF - because host kernel compromise on a shared GPU host reaches every tenant on that host and the node cannot be drained cheaply.

Who can reach it

Local user or container able to load a BPF program that calls a kfunc with an rdonly_buf_size/rdwr_buf_size argument, i.e. CAP_BPF/CAP_SYS_ADMIN in some namespace. Not reachable from an unprivileged pod with BPF blocked by seccomp or by the runtime default profile.

What to do

Take the stable kernel fix that rejects rdonly_buf_size/rdwr_buf_size values above U32_MAX where meta->r0_size is set; the commits are linked in the record. There is no runtime toggle beyond keeping BPF program loading away from tenants, so this is a kernel package update and a reboot of each GPU node - schedule it with the drain, since a GPU host cannot be live-patched for a verifier change.

References

Related entries

• Linux kernel BPF verifier: writes through untrusted BTF pointers bypass the read-only policyCVE-2026-93144 · Linux kernel BPF verifier (check_ptr_to_btf_access, PTR_UNTRUSTED writes)High
• Linux kernel BPF verifier: flexible-array relaxation allows BTF access past a MEM_ALLOC objectCVE-2026-93148 · Linux kernel BPF verifier (BTF struct walk of PTR_TO_BTF_ID | MEM_ALLOC objects)High
• Linux vhost-scsi: stale response iovecs after a memory-table change write into unrelated memoryCVE-2026-93782 · Linux kernel vhost-scsi (VHOST_SET_MEM_TABLE vs in-flight command iovecs)High
• Linux kernel perf: addr_filter_ranges freed without RCU grace period, leaving a use-after-freeCVE-2026-93817 · Linux kernel perf events (event::addr_filter_ranges RCU lifetime)High
• sudo: TZ from the calling user shifts NOTBEFORE/NOTAFTER windows, reviving expired rulesCVE-2026-96512 · sudo (NOTBEFORE/NOTAFTER sudoers time restrictions)High
• Linux slab allocator: ABA race in the optimistic freelist return corrupts the partial listCVE-2026-97941 · Linux kernel mm/slab (__slab_try_return_freelist ABA race)High