Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Add missing access_ok call to copy_user_syms As reported by sashiko we use __get_user without prior access_ok call on the user space pointer. Adding the missing call for the whole pointer array. Plus removing the err check in the error path, because it's not needed and also we can return -ENOMEM directly from the first kvmalloc_array fail path. [1] https://lore.kernel.org/bpf/20260611115503.AC16D1F00893@smtp.kernel.org/
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0236fec57a15dc2a068dfe4488e0c2ab4559b1ec to < a67f7f9647cb243b3be32163e88e5bc76e3d51e9affected0236fec57a15dc2a068dfe4488e0c2ab4559b1ec to < 8b719cef5ac30ab83ce5693c5faf10e4944874afaffected0236fec57a15dc2a068dfe4488e0c2ab4559b1ec to < 128391b57e0977c35243672a6f970073651f3831affected0236fec57a15dc2a068dfe4488e0c2ab4559b1ec to < 0b6252afcd1965f77c6a6f8a802a2e1381822b98affected0236fec57a15dc2a068dfe4488e0c2ab4559b1ec to < 28ce7bcf8a29aa395b60764df4c97be745de89d0affected0236fec57a15dc2a068dfe4488e0c2ab4559b1ec to < d5dc200c3a3f217de072af269dd90adddf90e48daffected
Linux Linux
Default version status: affected
5.19affected0 to < 5.19unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a67f7f9647cb243b3be32163e88e5bc76e3d51e9 ↗
- https://git.kernel.org/stable/c/8b719cef5ac30ab83ce5693c5faf10e4944874af ↗
- https://git.kernel.org/stable/c/128391b57e0977c35243672a6f970073651f3831 ↗
- https://git.kernel.org/stable/c/0b6252afcd1965f77c6a6f8a802a2e1381822b98 ↗
- https://git.kernel.org/stable/c/28ce7bcf8a29aa395b60764df4c97be745de89d0 ↗
- https://git.kernel.org/stable/c/d5dc200c3a3f217de072af269dd90adddf90e48d ↗