CVE-2026-93144: bpf: Reject writes through untrusted BTF pointers
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject writes through untrusted BTF pointers
checkptrtobtfaccess() lets program-type btfstructaccess callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy for untrusted BTF pointers created by helpers such as bpfrdonlycast().
Reject non-read accesses through PTRUNTRUSTED BTF pointers at the common entry point, before the callback branch to handle all cases.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to do to trigger this issue?
They need to perform a non-read access through an untrusted BTF pointer in a BPF program. Such pointers can be created by helpers including bpf_rdonly_cast().
Which BPF paths are affected?
The affected path is where program-type btf_struct_access callbacks validate a write before the default BTF access handling rejects non-read access. This ordering can bypass the intended read-only policy for PTR_UNTRUSTED BTF pointers.
What changes after the fix is applied?
Non-read accesses through PTR_UNTRUSTED BTF pointers are rejected at the common access-check entry point, before any btf_struct_access callback is invoked.
Which upstream changes can be used to verify the fix in source history?
The provided stable references identify commits 19d5566b84ca1af0256d0d0003e1a081580c3ba3 and ac65c710cc643cbc52b899627577357867249530.