Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't predict JMP32 pointer vs zero comparisons Consider the following program: r1 = map_value; /* low 32 bits are zero at runtime */ r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = *(u64 *)(r1 + 0); exit; l1: r6 = 0; goto l0; At the moment is_branch_taken() reports the jump as always taken, because it does not distinguish between BPF_JMP and BPF_JMP32 comparisons when processing 'if w1 != 0 ...'.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-09-25T11:17:32.880Z",
  "pubdate": "2026-09-25T11:17:32.880Z",
  "executiveSummary": "This vulnerability involves a logic error in the Linux kernel's BPF verifier related to jump prediction. The issue arises from the verifier's inability to distinguish between BPF_JMP and BPF_JMP32 operations during the analysis of conditional branching.\nSpecifically, the BPF verifier's is_branch_taken() function incorrectly predicts the outcome of pointer-to-zero comparisons when using 32-bit jump instructions (BPF_JMP32).\nThe vulnerability allows for potential verifier bypass, where the verifier makes incorrect assumptions about the state of registers after a branch.\nThis misprediction can lead to out-of-bounds memory access or arbitrary kernel memory read/write operations if an attacker crafts a BPF program that exploits this logic flaw. The defect affects the BPF subsystem, which is typically accessible to unprivileged users with CAP_BPF or root privileges on most systems, though BPF security hardening policies may mitigate general access.\nThe primary risk is the subversion of kernel memory safety via incorrect state tracking within the BPF verifier.",
  "technicalDetails": "The root cause of this vulnerability lies in the BPF verifier's is_branch_taken() function. When the verifier evaluates a conditional jump, it attempts to predict whether the branch will be taken to prune the search space for state exploration.\nIn the case of BPF_JMP32 instructions, the verifier fails to correctly differentiate between 64-bit and 32-bit register comparisons. When a BPF program performs a comparison against a pointer using 'if w1 != 0', the verifier may incorrectly treat the branch as 'always taken' or 'never taken' based on an incomplete state analysis.\nThe provided example demonstrates a program where r1 is assigned a map value (a pointer). At runtime, the low 32 bits of this pointer might be zero. If the verifier assumes the branch 'if w1 != 0' is always taken (or not taken), it will incorrectly resolve the subsequent register state for r1.\nIf the verifier incorrectly prunes one of the branches, it effectively ignores the state transitions that would occur if that branch were actually followed. By forcing the verifier to misjudge the outcome, an attacker can trick the verifier into accepting code that performs pointer arithmetic on registers it believes are constrained (e.g., zeroed) but actually contain valid map pointers.\nThe attack flow proceeds as follows: 1) The attacker injects a BPF program containing a specific 32-bit conditional jump against a register containing a pointer. 2) The verifier performs static analysis and incorrectly resolves the jump destination due to the lack of BPF_JMP vs BPF_JMP32 distinction in is_branch_taken(). 3) The verifier incorrectly prunes the 'false' branch, failing to account for the path where the register is not zeroed. 4) The kernel executes the BPF program, bypassing the safety checks that would normally prevent the subsequent memory access (e.g., r1 += r6) because the verifier thinks that code path is unreachable or operates on an invalid pointer state.\nThis behavior facilitates memory safety violations, as the verifier's register tracking state becomes desynchronized from the actual execution state. This can be weaponized to perform speculative or direct out-of-bounds access to kernel memory, potentially leading to arbitrary code execution or local privilege escalation."
}