CVE-2026-93144

bpf: Reject writes through untrusted BTF pointers

State: Published
Severity: 7.8 High
Published: Sep 17, 2026
Updated: Oct 21, 2026
Reserved: Sep 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject writes through untrusted BTF pointers

check_ptr_to_btf_access() lets program-type btf_struct_access callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy for untrusted BTF pointers created by helpers such as bpf_rdonly_cast().

Reject non-read accesses through PTR_UNTRUSTED BTF pointers at the common entry point, before the callback branch to handle all cases.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	282de143ead96a5d53331e946f31c977b4610a74 to before 56f92fecd80419567288b7972caa90107033836eAffected 282de143ead96a5d53331e946f31c977b4610a74 to before c4dc883447ae38c4e22a29cc016046fa65d88994Affected 282de143ead96a5d53331e946f31c977b4610a74 to before 644cf4e77c2770d4246f6d12f99bc80d253b0ec6Affected 282de143ead96a5d53331e946f31c977b4610a74 to before 19d5566b84ca1af0256d0d0003e1a081580c3ba3Affected 282de143ead96a5d53331e946f31c977b4610a74 to before ac65c710cc643cbc52b899627577357867249530Affected
LinuxLinux	6.2Affected before 6.2Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.6 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

282de143ead96a5d53331e946f31c977b4610a74 to before 56f92fecd80419567288b7972caa90107033836eAffected
282de143ead96a5d53331e946f31c977b4610a74 to before c4dc883447ae38c4e22a29cc016046fa65d88994Affected
282de143ead96a5d53331e946f31c977b4610a74 to before 644cf4e77c2770d4246f6d12f99bc80d253b0ec6Affected
282de143ead96a5d53331e946f31c977b4610a74 to before 19d5566b84ca1af0256d0d0003e1a081580c3ba3Affected
282de143ead96a5d53331e946f31c977b4610a74 to before ac65c710cc643cbc52b899627577357867249530Affected

LinuxLinux

6.2Affected
before 6.2Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.