CVE-2026-98037: bpf: Reject untrusted allocated-object pointers
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject untrusted allocated-object pointers
When the final RCU read-side critical section ends, a local kptr is demoted to PTRUNTRUSTED but retains MEMALLOC. The pointer may be NULL or may refer to an object whose lifetime is no longer protected.
typeisptrallocobj() nevertheless recognizes any PTRTOBTFID with MEMALLOC as a live allocated object. In particular, a refcount-only local kptr never carries NONOWNREF, so it still passes the bpfrefcountacquire() argument check after RCU protection ends. The kfunc can then dereference NULL or stale memory.
Make typeisptrallocobj() reject PTRUNTRUSTED pointers. Since typeisnonowningref() is based on the same predicate, graph kfunc arguments obey the same live-object requirement. Fault-protected reads of the demoted pointer remain valid: writes are already rejected, and read fixups use bpfmayfaultonderef() rather than this predicate.
[ kkd: Rewrote commit log ]
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the unsafe dereference?
A BPF program must use a local kptr after its final RCU read-side critical section ends, when the pointer has been demoted to PTR_UNTRUSTED but still retains MEM_ALLOC. It must then pass that pointer to bpf_refcount_acquire() or a graph kfunc argument path that incorrectly treats it as a live allocated object.
What can happen if the vulnerable pointer classification is reached?
The affected kfunc can dereference a NULL pointer or memory belonging to an object whose lifetime is no longer protected. The issue arises because the verifier recognizes the untrusted pointer as a live allocated object.
Are reads and writes through the demoted pointer handled the same way?
No. Writes through the demoted pointer are already rejected, while fault-protected reads remain valid because their fixups use bpf_may_fault_on_deref() rather than the allocated-object predicate.