CVE-2026-93125: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject rdonly/rdwrbufsize kfunc arguments that exceed u32 max
checkkfuncargs() detects a kfunc argument named rdonlybufsize or rdwrbufsize and stores reg->varoff.value into meta->r0size, a u64, and does not bound it. checkkfunccall() later copies that value into the returned register's memsize field:
meta->r0size = reg->varoff.value; ... regs[BPFREG0].memsize = meta.r0size;
regs[BPFREG0].memsize is u32. A constant whose upper 32 bits are set gets truncated instead of causing a load-time rejection, so the verifier records a PTRTOMEM register with an approximately 4 GiB memsize for whatever allocation the kfunc returned. A later access check against that register uses the truncated, wrong bound.
Reject rdonlybufsize/rdwrbufsize values that exceed U32MAX at the point meta->r0size is set.
Affected Software
Event History
Frequently Asked Questions
Which BPF programs are relevant to this issue?
The issue is relevant to BPF programs that call kfuncs with arguments named rdonly_buf_size or rdwr_buf_size. The problematic case is a constant size value whose upper 32 bits are set, meaning it exceeds U32_MAX.
When does the unsafe condition occur?
It occurs during BPF verifier processing when the kfunc argument size is recorded, and the value is later copied into a u32 mem_size field. The oversized value is truncated rather than rejected, causing subsequent access checks to use an incorrect bound.
How can I check whether a program uses the affected pattern?
Review kfunc calls in BPF programs for rdonly_buf_size or rdwr_buf_size arguments and identify constant values greater than U32_MAX. Such values should be rejected at program load time after the fix.