CVE-2026-92515 PUBLISHED

bpf: Preserve unique-field state across nested structs

Assigner: Linux
Reserved: 16.09.2026 Published: 17.09.2026 Updated: 17.09.2026

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve unique-field state across nested structs

btf_find_struct_field() initializes a fresh seen mask for every recursive descent. Unique special fields in different levels of the same aggregate therefore do not see one another. The duplicate fields can reach btf_parse_fields(), where they trigger an invariant WARN_ON_ONCE(). A crafted user BTF can consequently trigger the warning before map creation checks capabilities.

Initialize the seen mask once in btf_find_field() and pass the same pointer through struct, datasec, and nested-struct walks. This gives the entire field traversal one shared uniqueness state.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 64e8ee814819f21beeeda00d4119221443d77992 to cec97102d4147e18568c93946014c4c8ebf86fcf (excl.)
  • affected from 64e8ee814819f21beeeda00d4119221443d77992 to 28d5f20ed022ade0fb0bfbf50b78fec782083175 (excl.)
  • affected from 64e8ee814819f21beeeda00d4119221443d77992 to 373a1e9366e711b89bc5e45bd6edf33ef62402cd (excl.)
  • affected from 64e8ee814819f21beeeda00d4119221443d77992 to f08619f060468076e4acbdc10e0713af20d60e65 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.11 is affected
  • unaffected from 0 to 6.11 (excl.)
  • unaffected from 6.12.110 to 6.12.* (incl.)
  • unaffected from 6.18.52 to 6.18.* (incl.)
  • unaffected from 7.2.6 to 7.2.* (incl.)
  • unaffected from 7.3-rc1 to * (incl.)

References