Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve unique-field state across nested structs btf_find_struct_field() initializes a fresh seen mask for every recursive descent. Unique special fields in different levels of the same aggregate therefore do not see one another. The duplicate fields can reach btf_parse_fields(), where they trigger an invariant WARN_ON_ONCE(). A crafted user BTF can consequently trigger the warning before map creation checks capabilities. Initialize the seen mask once in btf_find_field() and pass the same pointer through struct, datasec, and nested-struct walks. This gives the entire field traversal one shared uniqueness state.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
64e8ee814819f21beeeda00d4119221443d77992 to < cec97102d4147e18568c93946014c4c8ebf86fcfaffected64e8ee814819f21beeeda00d4119221443d77992 to < 28d5f20ed022ade0fb0bfbf50b78fec782083175affected64e8ee814819f21beeeda00d4119221443d77992 to < 373a1e9366e711b89bc5e45bd6edf33ef62402cdaffected64e8ee814819f21beeeda00d4119221443d77992 to < f08619f060468076e4acbdc10e0713af20d60e65affected
Linux Linux
Default version status: affected
6.11affected0 to < 6.11unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected