CVE-2026-80865: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80865 Overview

CVE-2026-80865 affects the Linux kernel's Berkeley Packet Filter (BPF) subsystem. The vulnerability stems from a missing access_ok() call in the copy_user_syms function. Kernel code invokes __get_user on a user space pointer without first validating that the pointer references user space memory. This omission allows the kernel to dereference addresses that should be rejected before access.

The issue was reported by a contributor identified as sashiko and fixed across multiple stable branches. The patch adds the missing access_ok() check for the entire pointer array and streamlines the error path to return -ENOMEM directly from the first kvmalloc_array failure.

Critical Impact
Missing user pointer validation in BPF copy_user_syms can enable unprivileged local users to trigger unsafe kernel memory access through crafted pointer arrays.

Affected Products

Linux kernel BPF subsystem (upstream)
Stable kernel branches receiving backport commits 0b6252af, 128391b5, 28ce7bcf, 8b719cef, a67f7f96, and d5dc200c
Distribution kernels shipping the vulnerable copy_user_syms implementation

Discovery Timeline

2026-09-04 - CVE-2026-80865 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80865

Vulnerability Analysis

The defect resides in copy_user_syms, a BPF helper that copies an array of user space symbol pointers into kernel memory. The function calls __get_user on each pointer, which performs the read without validating the target address range. On architectures that rely on access_ok() to distinguish user and kernel memory, this omission bypasses a foundational safety check.

Without the check, the kernel may attempt to read memory ranges that a user process should not be permitted to reference through BPF. The fix wraps the whole pointer array with a single access_ok() invocation before entering the copy loop, matching kernel guidance for __get_user usage.

The patch also removes redundant error handling in the failure path and returns -ENOMEM directly when the initial kvmalloc_array call fails, reducing complexity in the corrected code.

Root Cause

The root cause is a missing input validation step before invoking an unchecked user access primitive. __get_user skips the range check by design and requires callers to invoke access_ok() on the user pointer beforehand. copy_user_syms did not perform this check, resulting in a violation of the kernel's user access contract.

Attack Vector

Exploitation requires local access to a system where BPF program loading or attachment is available to the calling user. An attacker crafts a symbol array with pointer values that would normally be rejected by access_ok() and passes it to the affected BPF interface. The kernel processes the pointers without validation, producing behavior that depends on the target address and architecture.

No public proof-of-concept exploit is listed in the enriched data, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list.

Detection Methods for CVE-2026-80865

Indicators of Compromise

Unexpected kernel warnings, oops messages, or BUG: entries referencing copy_user_syms or BPF symbol resolution paths
Kernel log entries citing invalid user access originating from BPF syscalls
Anomalous BPF program load attempts from non-administrative users on systems where kernel.unprivileged_bpf_disabled is not enforced

Detection Strategies

Inventory running kernels against the fixed commit hashes referenced in the upstream advisory and flag hosts still on vulnerable builds
Audit bpf() syscall usage through auditd rules and correlate with process identity and capabilities
Monitor for repeated BPF operations from the same non-root user identifier, which may indicate abuse attempts

Monitoring Recommendations

Enable kernel audit logging for the bpf syscall and forward records to a central logging platform for retention
Track kernel panics and oops events in fleet telemetry to spot anomalous crashes tied to BPF activity
Review host-based telemetry for processes invoking bpf() with symbol arrays, particularly outside expected observability tooling

How to Mitigate CVE-2026-80865

Immediate Actions Required

Apply the upstream kernel fix or the vendor backport that includes the access_ok() addition to copy_user_syms
Restrict BPF program loading to privileged users by setting kernel.unprivileged_bpf_disabled=1 where operationally acceptable
Prioritize patching on multi-tenant hosts and systems that expose BPF interfaces to lower-privileged workloads

Patch Information

The fix is available in the Linux kernel stable tree through the following commits: 0b6252af, 128391b5, 28ce7bcf, 8b719cef, a67f7f96, and d5dc200c. Consult your distribution's security tracker for the corresponding package updates.

Workarounds

Set kernel.unprivileged_bpf_disabled=1 through sysctl to prevent unprivileged users from loading BPF programs until patched kernels are deployed
Remove or restrict CAP_BPF and CAP_SYS_ADMIN from workloads that do not require BPF program loading
Apply Linux Security Module policies (SELinux or AppArmor) to constrain access to the bpf() syscall from untrusted services

bash

# Configuration example
# Disable unprivileged BPF program loading
sudo sysctl -w kernel.unprivileged_bpf_disabled=1

# Persist the setting across reboots
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/99-bpf-hardening.conf

# Verify the current setting
sysctl kernel.unprivileged_bpf_disabled