Linux kernel BPF verifier: flexible-array relaxation allows BTF access past a MEM_ALLOC object

Impact

BTF struct walking relaxes the struct-size check for accesses that land in a trailing flexible array. That is sound for ordinary type walking, but a PTR_TO_BTF_ID | MEM_ALLOC value points at an object allocated with the static BTF type size, so the relaxation let a verified program read and write past the end of the real allocation. The same gap applied to struct ID matching, so kfunc and kptr type checks could also walk off the object. The result is heap corruption in kernel allocations from a program the verifier accepted. On a multi-tenant GPU host that is a route from whatever component holds BPF load rights to full host control.

Who can reach it

Local user or container with BPF program load capability that can obtain a MEM_ALLOC BTF pointer (bpf_obj_new and friends) and walk a struct with a trailing flexible array. Requires CAP_BPF or equivalent; not reachable from a pod that cannot call bpf().

What to do

Pick up the stable kernel commits that reject the access before applying the flexible-array relaxation when walking a MEM_ALLOC object, and apply the same policy to struct ID matching. Kernel update, drain, reboot per node. No configuration-only fix.

References

Related entries

• Linux vhost-scsi: stale response iovecs after a memory-table change write into unrelated memoryCVE-2026-93782 · Linux kernel vhost-scsi (VHOST_SET_MEM_TABLE vs in-flight command iovecs)High
• Linux kernel perf: addr_filter_ranges freed without RCU grace period, leaving a use-after-freeCVE-2026-93817 · Linux kernel perf events (event::addr_filter_ranges RCU lifetime)High
• sudo: TZ from the calling user shifts NOTBEFORE/NOTAFTER windows, reviving expired rulesCVE-2026-96512 · sudo (NOTBEFORE/NOTAFTER sudoers time restrictions)High
• Linux slab allocator: ABA race in the optimistic freelist return corrupts the partial listCVE-2026-97941 · Linux kernel mm/slab (__slab_try_return_freelist ABA race)High
• Linux AMD IOMMU: sign-discarding error check lets nested domains use an unallocated domain IDCVE-2026-98002 · Linux kernel iommu/amd (amd_iommu_alloc_domain_nested error check)High
• Linux kernel BPF: per-CPU map updates index by logical CPU id, reading past the update bufferCVE-2026-98149 · Linux kernel BPF per-CPU map update paths (array, hash, cgroup storage)High