CVE-2026-80607: Linux Kernel BTF Parameter Parsing Flaw

CVE-2026-80607 Overview

CVE-2026-80607 affects the Linux kernel's tracing subsystem, specifically the parse_btf_arg function within kprobe event handling. A user can trigger a WARN_ON_ONCE() assertion by registering a kprobe event based on a raw address combined with a BPF Type Format (BTF) parameter. The condition is not an unexpected kernel state, yet the warning fires and pollutes kernel logs. Upstream maintainers resolved the issue by removing the erroneous WARN_ON_ONCE() call. The fix landed across multiple stable branches referenced by kernel Git commits 251a8fe, 8a662d8, and f148f86.

Critical Impact
A local user with permission to create kprobe events can spam kernel logs with WARN_ON_ONCE splats, potentially aiding log-noise-based evasion or triggering downstream alerting on kernel warnings.

Affected Products

Linux kernel (tracing/probes subsystem, parse_btf_arg)
Kernel builds with CONFIG_KPROBES and BTF support enabled
Stable branches receiving backports 251a8fe1b9ae, 8a662d8c05e2, and f148f86c65b8

Discovery Timeline

2026-08-28 - CVE-2026-80607 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80607

Vulnerability Analysis

The Linux kernel tracing/probes subsystem parses user-supplied probe definitions through parse_btf_arg. This function interprets BTF-typed argument specifications when a user creates a kprobe event. The original implementation contained a WARN_ON_ONCE() guard intended to flag unexpected internal states. However, a user creating a kprobe event with a raw kernel address alongside a BTF parameter reaches this branch through a legitimate, user-driven code path. The warning therefore misclassifies a normal user error as a kernel bug and emits a stack trace to the kernel ring buffer.

The maintainers determined the condition is reachable by design and reclassified it as a standard input validation failure. The remediation removes the WARN_ON_ONCE() while preserving the error return path, so probe registration still fails cleanly without generating a spurious warning.

Root Cause

The root cause is an incorrect use of WARN_ON_ONCE() for a state that user input can reach. Kernel warnings are reserved for conditions that indicate programming errors inside the kernel. Here, the parser encountered an argument combination that user space controls, making the assertion a false positive.

Attack Vector

A local user with the ability to write to the tracing interface (typically tracefs or debugfs, gated by CAP_SYS_ADMIN or equivalent) creates a kprobe event referencing a raw address and a BTF-typed argument. The parser reaches the flagged branch and emits a kernel warning. Repeated invocation floods dmesg and any downstream log pipeline. See the upstream kernel commit f148f86 for the exact code path removed.

// No verified exploit code is available for this issue.
// See the referenced kernel.org commits for the source-level fix.

Detection Methods for CVE-2026-80607

Indicators of Compromise

Repeated WARN_ON_ONCE stack traces originating from parse_btf_arg in kernel logs
Unexpected kprobe event registration attempts in /sys/kernel/tracing/kprobe_events or /sys/kernel/debug/tracing/kprobe_events
Kernel ring buffer entries referencing raw addresses combined with BTF argument syntax

Detection Strategies

Audit access to tracing interfaces and correlate write operations to kprobe_events with the source user and process
Alert on kernel warnings referencing trace_probe, parse_btf_arg, or traceprobe_parse_probe_arg in dmesg and syslog forwarders
Baseline legitimate tracing tool usage (perf, bpftrace, ftrace wrappers) and flag out-of-band kprobe registrations

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and create rules for repeated WARN_ON_ONCE events from tracing paths
Track processes invoking perf_event_open or writing to tracefs outside approved maintenance windows
Monitor package inventory to confirm kernel versions include the backport commits 251a8fe, 8a662d8, or f148f86

How to Mitigate CVE-2026-80607

Immediate Actions Required

Apply the stable-tree kernel update containing commits 251a8fe1b9ae, 8a662d8c05e2, or f148f86c65b8 from the Linux stable tree
Restrict access to tracefs and debugfs to administrators only
Review which service accounts hold CAP_SYS_ADMIN and remove the capability where not required

Patch Information

The fix removes the WARN_ON_ONCE() from parse_btf_arg in the kernel tracing/probes code. Reference the upstream commits: 251a8fe, 8a662d8, and f148f86. Consult your Linux distribution's security tracker for backported package versions.

Workarounds

Mount tracefs and debugfs with restrictive permissions or leave them unmounted on production systems that do not require live tracing
Set kernel.kptr_restrict=2 and kernel.perf_event_paranoid=3 to limit unprivileged access to kernel address information and performance events
Rate-limit kernel log ingestion downstream to prevent warning floods from disrupting alerting pipelines

bash

# Reduce exposure of kernel tracing to non-root users
sysctl -w kernel.kptr_restrict=2
sysctl -w kernel.perf_event_paranoid=3
mount -o remount,mode=700 /sys/kernel/debug
mount -o remount,mode=700 /sys/kernel/tracing