Linux kernel BPF verifier: writes through untrusted BTF pointers bypass the read-only policy

Impact

check_ptr_to_btf_access() let a program type's btf_struct_access callback validate a write before the default BTF path could reject non-read accesses. That bypassed the read-only policy that is supposed to apply to untrusted BTF pointers, such as those produced by bpf_rdonly_cast(). A loaded program could therefore write through a pointer the verifier had already decided it must not trust, giving kernel memory corruption of attacker-chosen targets. This is a different hole from the size-truncation and MEM_ALLOC bounds bugs in the same batch - it is a policy-ordering mistake, not a bound arithmetic mistake - so verify your kernel carries all three fixes rather than assuming one backport covers them.

Who can reach it

Local user or container that can load BPF programs (CAP_BPF/CAP_SYS_ADMIN in a namespace) and call bpf_rdonly_cast() or a similar untrusted-pointer helper. Unreachable where BPF program loading is denied to tenants.

What to do

Update to a stable kernel containing the fix that rejects non-read accesses through PTR_UNTRUSTED BTF pointers at the common entry point before the callback branch; commits are in the record. Kernel package update plus drain and reboot of each affected node; no vendor mitigation short of removing BPF load capability from workloads.

References

Related entries

• Linux kernel BPF verifier: flexible-array relaxation allows BTF access past a MEM_ALLOC objectCVE-2026-93148 · Linux kernel BPF verifier (BTF struct walk of PTR_TO_BTF_ID | MEM_ALLOC objects)High
• Linux vhost-scsi: stale response iovecs after a memory-table change write into unrelated memoryCVE-2026-93782 · Linux kernel vhost-scsi (VHOST_SET_MEM_TABLE vs in-flight command iovecs)High
• Linux kernel perf: addr_filter_ranges freed without RCU grace period, leaving a use-after-freeCVE-2026-93817 · Linux kernel perf events (event::addr_filter_ranges RCU lifetime)High
• sudo: TZ from the calling user shifts NOTBEFORE/NOTAFTER windows, reviving expired rulesCVE-2026-96512 · sudo (NOTBEFORE/NOTAFTER sudoers time restrictions)High
• Linux slab allocator: ABA race in the optimistic freelist return corrupts the partial listCVE-2026-97941 · Linux kernel mm/slab (__slab_try_return_freelist ABA race)High
• Linux AMD IOMMU: sign-discarding error check lets nested domains use an unallocated domain IDCVE-2026-98002 · Linux kernel iommu/amd (amd_iommu_alloc_domain_nested error check)High