CVE-2026-98611: bpf: Check params size before reading reserved fields
In the Linux kernel, the following vulnerability has been resolved:
bpf: Check params size before reading reserved fields
bpfcryptoctxcreate() is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function nevertheless reads params->reserved[0] and params->reserved[1] (offsets 14 and 15) before comparing paramssz against the size of struct bpfcryptoparams, so a BPF program can pass a shorter buffer and have the kernel read past the region that was validated for it.
Move the size check in front of the reserved field reads.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In bpf_crypto_ctx_create(), check params__sz against the size of struct bpf_crypto_params before reading params->reserved[0] or params->reserved[1].
Event History
Frequently Asked Questions
What does an attacker need to trigger the out-of-bounds read?
An attacker needs to run a BPF program that invokes the bpf_crypto_ctx_create() kfunc and supplies a params buffer shorter than struct bpf_crypto_params. The verifier validates only the declared params__sz length, while the vulnerable function reads reserved fields at offsets 14 and 15 before checking that length.
How can I determine whether a kernel contains the fix?
Check whether the kernel includes the change that moves the params size check ahead of reads of params->reserved[0] and params->reserved[1] in bpf_crypto_ctx_create(). The provided stable references identify commits carrying this correction.