CVE-2026-80865 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Add missing access_ok call to copy_user_syms
As reported by sashiko we use __get_user without prior access_ok call on the user space pointer. Adding the missing call for the whole pointer array.
Plus removing the err check in the error path, because it's not needed and also we can return -ENOMEM directly from the first kvmalloc_array fail path.
[1] https://lore.kernel.org/bpf/[email protected]/
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel's BPF subsystem contains a critical security flaw related to improper validation of user-supplied pointers during the process of copying symbol information. Specifically, in the function responsible for handling copy_user_syms operations, the code utilizes __get_user to retrieve data from a user-space pointer without first verifying that this memory region is accessible via an access_ok check. This omission represents a fundamental violation of kernel security principles regarding boundary checks between untrusted user space and privileged kernel space. The vulnerability arises because the system attempts to read directly from a potentially malicious or invalid address, bypassing the necessary safeguards designed to prevent unauthorized memory access.
This technical flaw aligns with CWE-20 Improper Input Validation, as the application fails to adequately verify that input data meets specified criteria before processing it. Furthermore, this scenario is characteristic of CWE-125 Out-of-bounds Read, where reading from a buffer beyond its allocated boundary can occur if the pointer points to unmapped or restricted memory regions. In the context of the MITRE ATT&CK framework for Linux systems, this vulnerability facilitates techniques associated with Tactic TA0006 Discovery and potentially TA0005 Defense Evasion, as an attacker could leverage such a flaw to probe kernel memory layouts or trigger crashes that obscure their presence. The lack of access control checks allows for potential information disclosure if the read operation succeeds in accessing valid but sensitive kernel data structures, although it more commonly results in immediate system instability.
The operational impact of this vulnerability is severe and multifaceted. Primarily, attempting to dereference an invalid user-space pointer without prior validation typically triggers a page fault within the kernel context. Since these faults are not handled gracefully when they stem from unchecked inputs, the result is often a Kernel Panic or Oops, leading to a complete denial of service for the affected system. In more sophisticated attack scenarios, if the memory layout allows it, an attacker might exploit this flaw to read arbitrary kernel memory contents, potentially leaking cryptographic keys, process credentials, or other sensitive information that resides in kernel space but happens to be mapped at addresses close to the user-provided pointer. This undermines the integrity and confidentiality guarantees provided by the operating system's security model.
The resolution involves inserting a mandatory access_ok call before any attempt to copy data from the user-space array using __get_user. This ensures that every element in the pointer array is validated against the current process memory limits, preventing access to unmapped or protected regions. Additionally, the fix includes code cleanup by removing an unnecessary error check in the error path and optimizing allocation failure handling by returning -ENOMEM directly upon the first kvmalloc_array failure. These changes not only patch the security hole but also improve code robustness and performance. To mitigate this risk, administrators should apply the latest kernel updates that include this specific BPF subsystem fix. Regularly updating to patched versions ensures that these boundary checks are enforced correctly, maintaining the separation between user and kernel spaces and preventing exploitation of input validation weaknesses.