CVE-2026-74590: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
In the Linux kernel, the following vulnerability has been resolved:
fsverity: Fix bpfgetfsveritydigest() dynptr assumptions
The BPF verifier and the dynptr abstraction ensure that the memory space referenced by a dynptr remains valid. They do not, however, provide any guarantee that the contents of the memory are stable. kfuncs are expected to remain memory-safe even if concurrent modifications occur.
bpfgetfsveritydigest() didn't follow that: it could crash if arg->digestsize was concurrently modified.
Fix that by using the known-good value hashalg->digestsize instead.
Also widen 'dynptrsz' and 'outdigestsz' to u64 to match the return type of bpfdynptrsize(). It doesn't appear that it can actually be more than INTMAX currently (since bpfdynptrdatarw() excludes file-based pointers), but the correct type might as well be used.
Affected Software
Event History
Frequently Asked Questions
What condition is required to trigger the crash?
The crash requires concurrent modification of arg->digest_size while bpf_get_fsverity_digest() is using it. The issue stems from relying on dynptr-backed memory whose contents may change even though the memory remains valid.
What is the impact of the flaw?
A concurrent change to the digest_size field can cause bpf_get_fsverity_digest() to crash. The fix avoids the mutable field and uses the known-good hash_alg->digest_size value instead.
Are fixes available?
Yes. The provided stable kernel references contain the resolved change, including commits 1344b632cb5043e32939a84568125719111c5af3, 2a5cfcad1d56e26d645b7887b0ed24c371851525, and 5bd63cad9df4328a184c409fbdad4f17944bcdb8.