CVE-2026-93112: bpf: Require a BPF cpumask for bpf_cpumask_populate()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Require a BPF cpumask for bpfcpumaskpopulate()
bpfcpumaskpopulate() writes to its destination with bitmapcopy(), but the destination is typed as struct cpumask . That allows the verifier to accept borrowed cpumask pointers returned by read-only kfuncs, such as scxbpfgetonlinecpumask(), as a writable destination.
Make the destination a struct bpfcpumask so populate follows the same ownership rule as the other mutating cpumask kfuncs. Query kfuncs continue to accept const struct cpumask inputs.
Affected Software
Event History
Frequently Asked Questions
What condition makes a system exposed to this issue?
Exposure exists when a BPF program can invoke bpf_cpumask_populate() with a borrowed cpumask pointer returned by a read-only kfunc, such as scx_bpf_get_online_cpumask(), as its destination.
What does the fix change for BPF programs using cpumask kfuncs?
The destination argument is changed from struct cpumask * to struct bpf_cpumask *. This makes bpf_cpumask_populate() require an owned BPF cpumask destination, while query kfuncs still accept const struct cpumask * inputs.