Linux Kernel up to 7.2.5 BPF Verifier check_kfunc_args rdonly_buf_size/rdwr_buf_size out-of-bounds write

Summaryinfo

A vulnerability has been found in Linux Kernel up to 7.2.5 and classified as very critical. This impacts the function check_kfunc_args of the component BPF Verifier. The manipulation of the argument rdonly_buf_size/rdwr_buf_size leads to out-of-bounds write. This vulnerability is uniquely identified as CVE-2026-93125. Local access is required to approach this attack. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.2.5. This issue affects the function check_kfunc_args of the component BPF Verifier. The manipulation of the argument rdonly_buf_size/rdwr_buf_size with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max check_kfunc_args() detects a kfunc argument named rdonly_buf_size or rdwr_buf_size and stores reg->var_off.value into meta->r0_size, a u64, and does not bound it. check_kfunc_call() later copies that value into the returned register's mem_size field: meta->r0_size = reg->var_off.value; ... regs[BPF_REG_0].mem_size = meta.r0_size; regs[BPF_REG_0].mem_size is u32. A constant whose upper 32 bits are set gets truncated instead of causing a load-time rejection, so the verifier records a PTR_TO_MEM register with an approximately 4 GiB mem_size for whatever allocation the kfunc returned. A later access check against that register uses the truncated, wrong bound. Reject rdonly_buf_size/rdwr_buf_size values that exceed U32_MAX at the point meta->r0_size is set.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2026-93125 since 09/17/2026. The exploitation is known to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/17/2026).

Upgrading to version 7.2.6 or 7.3-rc1 eliminates this vulnerability. Applying the patch 56a3846830ac95a472297d0cbba75cbff29540bb/2aaf67f0516fde29620d0edfc29c01b9ea7ad430 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion