CVE-2026-64354: bpf: Validate BTF repeated field counts before expansion
In the Linux kernel, the following vulnerability has been resolved:
bpf: Validate BTF repeated field counts before expansion
btfparsestructmetas() walks user-supplied BTF during BPFBTFLOAD, and btfrepeatfields() expands repeatable fields from array elements into the fixed BTFFIELDSMAX scratch array used by btfparsefields().
The remaining-capacity check performs the expanded field count calculation in u32. A malformed BTF can wrap that calculation, causing the check to pass even when the expanded field count exceeds the scratch array capacity. The following memcpy() can then write past the end of the array.
Use checked addition and multiplication before copying repeated fields and reject impossible counts.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates local access and low privileges are required. Exploitation involves supplying malformed BTF through the BPF_BTF_LOAD path; no user interaction is required.
What security impact could successful exploitation have?
The issue can cause a memcpy operation to write past a fixed scratch-array boundary in the kernel. The assigned CVSS vector rates confidentiality, integrity, and availability impact as high.
What does the available fix change?
The fix uses checked addition and multiplication when calculating expanded repeated-field counts, and rejects counts that cannot fit safely before copying fields.