Loading story…
A flaw in the Linux kernel's BPF disassembler was reported after syzbot and UBSAN identified an out-of-bounds array access in print_bpf_insn(), the function used to format BPF instructions for verifier diagnostics. The bug is triggered when a malformed signed-load instruction using BPF_MEMSX | BPF_DW reaches diagnostic disassembly code before opcode validation fully rejects it, causing the kernel to index past the end of the three-entry bpf_ldsx_string[] table. No evidence has been presented that the issue enables privilege escalation, information disclosure, remote exploitation, or abuse by unprivileged users.
A two-patch fix was proposed and then applied to bpf/bpf.git, changing the disassembler to reject invalid signed double-word load encodings and fall back to the existing BUG_ldx diagnostic path instead of performing the unsafe table lookup. The patch series, authored by Kumar Kartikeya Dwivedi, reviewed by Jiayuan Chen, and merged by Daniel Borkmann, also adds a self-test to catch regressions. The issue appears to exist in current kernel source, but affected released versions and downstream distributions have not yet been identified.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The two-patch series was applied to bpf/bpf.git master by Daniel Borkmann, including the disassembler fix and a regression selftest. Patchwork-bot announced the applied commits as 37e5c4f4d285 for the fix and 175a58668e2d for the selftest.
Kumar Kartikeya Dwivedi submitted a two-patch bpf-next series to treat signed double-word loads as invalid in print_bpf_insn() and add a selftest for the malformed instruction. The fix prevents the disassembler from indexing past bpf_ldsx_string[] and instead falls back to the existing invalid-instruction diagnostic path.
syzbot reported an out-of-bounds array access in the Linux kernel function print_bpf_insn(), triggered by a malformed BPF_MEMSX | BPF_DW instruction reaching diagnostic disassembly code. The issue was reproduced with UBSAN, which detected an array index past the end of the signed-load mnemonic table.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
linuxsecurity.com
Open sourcelore.kernel.org
Open sourcesyzkaller.appspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two Linux kernel use-after-free vulnerabilities were disclosed in packet-filtering components, exposing systems to local privilege escalation. **CVE-2026-23111** affects the `nftables` subsystem and stems from an inverted conditional in `nft_map_catchall_activate()` that mishandles catchall elements during transaction aborts, leaving a dangling chain reference. A public technical write-up and working exploit showed the bug can achieve root privileges with high reliability on Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS by corrupting chain reference counts, bypassing KASLR, leaking heap addresses, hijacking control flow with a fake `nft_expr_ops` structure, and executing a ROP chain that calls `commit_creds(&init_cred)`. The exploit also uses `switch_task_namespaces()` to break out of namespaces and containers. A separate flaw, **CVE-2026-23412**, affects the Linux kernel’s BPF netfilter link implementation in `nf_bpf_link.c`, where synchronous deallocation of `bpf_nf_link_lops` allowed concurrent `nfnetlink` hook enumeration to access freed memory during BPF link destruction. Researchers reproduced KASAN slab-use-after-free crashes in `nfnl_hook_dump_one` on kernel `6.14.0` and said the bug could be exploited through heap spraying and function-pointer hijacking in the `kmalloc-192` slab cache. The issue was introduced in `6.4-rc1` and fixed in `7.0-rc5` by commit `24f90fa3994b`, which switches to RCU-deferred freeing, while the `nftables` bug was patched upstream by commit `f41c5d1`; administrators were urged to deploy patched kernels promptly.
Jun 29, 2026
**CVE-2024-41009** is an out-of-bounds memory-access flaw in the Linux kernel BPF ring-buffer implementation. A privileged local attacker can manipulate the consumer position and the ring buffer's double-mapped circular layout to obtain overlapping record reservations, then alter an earlier record header so that `bpf_ringbuf_commit()` accesses an incorrect page, potentially crashing the kernel. The weakness is associated with CWE-121, stack-based buffer overflow, and affects the handling of outstanding BPF ring-buffer records. The upstream fix tracks the oldest pending record position and rejects reservations when the range of outstanding records would exceed the ring-buffer size. Red Hat rates the issue **Moderate** (CVSS 3.1: 4.4), requiring local high privileges and primarily enabling denial of service; NVD assigns 5.5, while CVE.org reports 7.8 with confidentiality and integrity impacts. Red Hat issued kernel updates for multiple RHEL 8 and RHEL 9 streams, including extended-support variants, and reports no qualifying mitigation beyond applying the updates.
Aug 26, 2026
**CVE-2024-56675** is a use-after-free flaw in Linux kernel eBPF tracing introduced in kernel 6.0. Non-sleepable BPF programs attached to uprobes could be freed after a normal RCU grace period while uprobe execution still accessed them under tasks-trace-RCU protection, creating an unsafe lifetime mismatch. The upstream fix waits for a tasks-trace-RCU grace period after removing the BPF attachment from its `perf_event`; fixed stable releases include 6.1.121, 6.6.67, 6.12.6, and 6.13-rc3. Red Hat rated the issue **Moderate** (CVSS 6.7) because default RHEL configurations disable unprivileged eBPF, requiring `CAP_SYS_ADMIN` or root privileges to exploit it. Fixes are available for RHEL 9 and RHEL 10 through RHSA-2025:20518 and RHSA-2025:20095, respectively; RHEL 9 kernel-rt remains affected, while RHEL 6, RHEL 8, and RHEL 8 kernel-rt are not affected. Organizations should deploy the applicable kernel update, with particular attention to systems where privileged users can load or attach eBPF programs.
Aug 26, 2026