CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms
In the Linux kernel, the following vulnerability has been resolved:
bpf: Add missing accessok call to copyusersyms
As reported by sashiko we use getuser without prior accessok call on the user space pointer. Adding the missing call for the whole pointer array.
Plus removing the err check in the error path, because it's not needed and also we can return -ENOMEM directly from the first kvmallocarray fail path.
[1] https://lore.kernel.org/bpf/20260611115503.AC16D1F00893@smtp.kernel.org/
Event History
Frequently Asked Questions
What condition is required to trigger this issue?
The vulnerable path is reached when copy_user_syms processes a user-space pointer array. The issue occurs because __get_user is used on that pointer without first validating the full array with access_ok.
How can I determine whether a kernel includes the fix?
Check whether the kernel source or applied stable patches includes one of these commits: a67f7f9647cb243b3be32163e88e5bc76e3d51e9, 8b719cef5ac30ab83ce5693c5faf10e4944874af, or 128391b57e0977c35243672a6f970073651f3831. The remediation adds an access_ok check for the complete pointer array before accessing it.