CVE-2026-92515: bpf: Preserve unique-field state across nested structs
In the Linux kernel, the following vulnerability has been resolved:
bpf: Preserve unique-field state across nested structs
btffindstructfield() initializes a fresh seen mask for every recursive descent. Unique special fields in different levels of the same aggregate therefore do not see one another. The duplicate fields can reach btfparsefields(), where they trigger an invariant WARNONONCE(). A crafted user BTF can consequently trigger the warning before map creation checks capabilities.
Initialize the seen mask once in btffindfield() and pass the same pointer through struct, datasec, and nested-struct walks. This gives the entire field traversal one shared uniqueness state.
Event History
Frequently Asked Questions
Does map creation capability enforcement prevent this issue from being triggered?
No. A crafted user BTF can reach the duplicate-field handling and trigger the invariant WARN_ON_ONCE() before map creation capability checks occur.
How can I tell whether the issue has been triggered?
The affected path triggers an invariant WARN_ON_ONCE() when duplicate unique special fields from nested aggregate levels reach btf_parse_fields().