CVE-2025-38591 bpf: Reject narrower access to pointer ctx fields

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = u8 r1 + 169; exit; With pointer field sk being at offset 168 in skbuff. This access is...

CVE-2025-38591 bpf: Reject narrower access to pointer ctx fields

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = u8 r1 + 169; exit; With pointer field sk being at offset 168 in skbuff. This access is...

The vulnerability of the check_max_stack_depth() function in the kernel/bpf/verifier.c module, which is part of the BPF interpreter support in the Linux operating system’s kernel, allows a hacker to access protected information or trigger a service failure.

The vulnerability of the checkmaxstackdepth function in the kernel/bpf/verifier.c module, which is part of the BPF interpreter support in the Linux operating system, involves reading beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to access protected informatio...

The vulnerability of the check_helper_mem_access() function in the kernel/bpf/verifier.c module of the Linux operating system allows a attacker to compromise the integrity and accessibility of the protected information.

The vulnerability of the checkhelpermemaccess function in the kernel/bpf/verifier.c module of the Linux operating system is related to errors in the code. Exploiting this vulnerability could allow an attacker to compromise the integrity and accessibility of the protected information...

The vulnerability of the check_func_arg() function in the kernel/bpf/verifier.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the checkfuncarg function in the kernel/bpf/verifier.c module of the Linux operating system is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

PT-2025-28999

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.15.0-rc4 Description: A flaw was discovered in the Linux kernel's BPF Berkeley Packet Filter verifier. The issue involves not excluding the stack pointer register during precision backtracking bookkeeping,...

UBUNTU-CVE-2025-37938

In the Linux kernel, the following vulnerability has been resolved: tracing: Verify event formats that have "%p.." The trace event verifier checks the formats of trace events to make sure that they do not point at memory that is not in the trace event itself or in data that will never be freed. I...

SUSE CVE-2023-52928

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip invalid kfunc call in backtrackinsn The verifier skips invalid kfunc call in checkkfunccall, which would be captured in fixupkfunccall if such insn is not eliminated by dead code elimination. However, this can lead to t...

kernel: bpf: Fix a kernel verifier crash in stacksafe()

A flaw was found in the Linux kernel. A local attacker with specific privileges could trigger an invalid memory access within the BPF Berkeley Packet Filter verifier's stacksafe function. This out-of-bounds access could lead to a kernel crash, resulting in a Denial of Service DoS for the system...

CVE-2023-52920

In the Linux kernel, the following vulnerability has been resolved: bpf: support non-r10 register spill/fill to/from stack in precision tracking Use instruction jump history to record instructions that performed register spill/fill to/from stack, regardless if this was done through read-only r10...

bpf: Fix a kernel verifier crash in stacksafe()

...

UBUNTU-CVE-2024-45020

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a kernel verifier crash in stacksafe Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Further investigation shows that the crash is due to invalid memory access in stacksafe. More specifically,...

CVE-2024-45020 bpf: Fix a kernel verifier crash in stacksafe()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a kernel verifier crash in stacksafe Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Further investigation shows that the crash is due to invalid memory access in stacksafe. More specifically,...

CVE-2024-45020 bpf: Fix a kernel verifier crash in stacksafe()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a kernel verifier crash in stacksafe Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Further investigation shows that the crash is due to invalid memory access in stacksafe. More specifically,...

CVE-2024-45020

Concrete details found: CVE-2024-45020 affects the Linux kernel BPF verifier, specifically a crash in stacksafe() caused by out-of-bounds memory access when iterating old->allocated_stack. The fix adds a check i >= cur->allocated_stack to fail stacksafe() when the condition would access ...

CVE-2024-45020 bpf: Fix a kernel verifier crash in stacksafe()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a kernel verifier crash in stacksafe Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Further investigation shows that the crash is due to invalid memory access in stacksafe. More specifically,...

The vulnerability of the `check_stack_slot_within_bounds()` function in the kernel/bpf/verifier.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the checkstackslotwithinbounds function in the kernel/bpf/verifier.c module of the Linux operating system is related to reading memory beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the check_stack_write_fixed_off() function in the kernel/bpf/verifier.c module of the Linux operating system allows a attacker to compromise the integrity of the protected information.

The vulnerability of the checkstackwritefixedoff function in the kernel/bpf/verifier.c module of the Linux operating system is related to incorrect register checking. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

The vulnerability of the backtrack_insn() function in the kernel/bpf/verifier.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the backtrackinsn function in the kernel/bpf/verifier.c module of the Linux operating system is related to calls outside of the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

SUSE CVE-2017-9150

The docheck function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allowptrleaks value available for restricting the output of the printbpfinsn function, which allows local users to obtain sensitive address information via crafted bpf system calls...