CVE-2026-97420: bpf: NUL-terminate replaced sysctl value
In the Linux kernel, the following vulnerability has been resolved:
bpf: NUL-terminate replaced sysctl value
When writing to sysctls, procsyscallhandler() guarantees that the buffer passed to proc handlers is NUL-terminated. If bpfsysctlsetnewvalue() replaces the pending sysctl value, it can hand a replacement buffer directly to proc handlers. However, the helper currently copies only buflen bytes into that buffer without appending a NUL terminator, leaving downstream parsers vulnerable to out-of-bounds access.
Fix this by appending a '\0' after the replaced value to restore the expected sysctl semantics. Since the helper already rejects buflen greater than PAGESIZE - 1, there is always room for the extra byte.
Reproduced in a QEMU x8664 guest booted with KASAN while exercising the sysctl replacement path with a cgroup/sysctl BPF program. The reproducer targets /proc/sys/net/core/flowlimitcpubitmap, fills the original user write buffer with non-zero bytes, and overrides the sysctl value so the replacement buffer lacks a terminating NUL. Under that setup, the pre-fix kernel reported:
BUG: KASAN: slab-out-of-bounds in strnchrnul+0x72/0x90 Read of size 1 at addr ffff88800de57000 by task repropatch3/66 CPU: 0 UID: 0 PID: 66 Comm: repropatch3 Not tainted 7.1.0-rc3-00269-g8370ca1f87cc #6 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dumpstacklvl+0x68/0xa0 printreport+0xcb/0x5e0 ? virtaddrvalid+0x21d/0x3f0 ? strnchrnul+0x72/0x90 ? strnchrnul+0x72/0x90 kasanreport+0xca/0x100 ? strnchrnul+0x72/0x90 strnchrnul+0x72/0x90 bitmapparse+0x37/0x2e0 flowlimitcpusysctl+0xc6/0x840 ? pfxflowlimitcpusysctl+0x10/0x10 ? kvmallocnodenoprof+0x5ba/0x870 procsyscallhandler+0x31d/0x480 ? pfxprocsyscallhandler+0x10/0x10 ? selinuxfilepermission+0x39f/0x500 ? lockisheldtype+0x9e/0x120 vfswrite+0x98e/0x1000 ... </TASK> The buggy address is located 0 bytes to the right of allocated 4096-byte region [ffff88800de56000, ffff88800de57000) With this fix applied, rerunning the same sysctl-targeted path yields no corresponding KASAN reports.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In bpf_sysctl_set_new_value(), append a NUL terminator ('\0') after the replaced sysctl value so the replacement buffer passed to proc handlers is NUL-terminated.
Event History
Frequently Asked Questions
What conditions are required to reach the vulnerable path?
The path is reached when a cgroup/sysctl BPF program uses bpf_sysctl_set_new_value() to replace a pending sysctl value. The replacement value must then be passed to a proc sysctl handler that expects the buffer to be NUL-terminated.
Are ordinary sysctl writes affected without BPF-based value replacement?
The described flaw is specifically in replacement values supplied through bpf_sysctl_set_new_value(). Normal writes handled through proc_sys_call_handler() are described as receiving a NUL-terminated buffer.
How can an affected system be identified during testing?
The issue was reproduced in a KASAN-enabled QEMU x86_64 guest while exercising the sysctl replacement path with a cgroup/sysctl BPF program. The reported symptom on the pre-fix kernel was a KASAN slab-out-of-bounds read in strnchrnul.