CVE-2026-53095: bpf: Fix abuse of kprobe_write_ctx via freplace

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix abuse of kprobewritectx via freplace

uprobe programs are allowed to modify struct ptregs.

Since the actual program type of uprobe is KPROBE, it can be abused to modify struct ptregs via kprobe+freplace when the kprobe attaches to kernel functions.

For example,

SEC("?kprobe") int kprobe(struct ptregs regs) { return 0; }

SEC("?freplace") int freplacekprobe(struct ptregs regs) { regs->di = 0; return 0; }

freplacekprobe prog will attach to kprobe prog. kprobe prog will attach to a kernel function.

Without this patch, when the kernel function runs, its first arg will always be set as 0 via the freplacekprobe prog.

To fix the abuse of kprobewritectx=true via kprobe+freplace, disallow attaching freplace programs on kprobe programs with different kprobewritectx values.