CVE-2026-93112 (GCVE-0-2026-93112)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:11 – Updated: 2026-09-18 17:56
VLAI
Title
bpf: Require a BPF cpumask for bpf_cpumask_populate()
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Require a BPF cpumask for bpf_cpumask_populate() bpf_cpumask_populate() writes to its destination with bitmap_copy(), but the destination is typed as struct cpumask *. That allows the verifier to accept borrowed cpumask pointers returned by read-only kfuncs, such as scx_bpf_get_online_cpumask(), as a writable destination. Make the destination a struct bpf_cpumask * so populate follows the same ownership rule as the other mutating cpumask kfuncs. Query kfuncs continue to accept const struct cpumask * inputs.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 950ad93df2fce70445e655ed2e74f5c1a8653ab2 , < 0cfc9348a045da64955af2dd6902e66dfc7d6469 (git)
Affected: 950ad93df2fce70445e655ed2e74f5c1a8653ab2 , < b7e2a5c6519adc73be55c3de2cb545e095a0fbc5 (git)
Affected: 950ad93df2fce70445e655ed2e74f5c1a8653ab2 , < 8740156ad33be5071b588b594c55f279457f667c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/cpumask.c",
            "tools/sched_ext/include/scx/compat.bpf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0cfc9348a045da64955af2dd6902e66dfc7d6469",
              "status": "affected",
              "version": "950ad93df2fce70445e655ed2e74f5c1a8653ab2",
              "versionType": "git"
            },
            {
              "lessThan": "b7e2a5c6519adc73be55c3de2cb545e095a0fbc5",
              "status": "affected",
              "version": "950ad93df2fce70445e655ed2e74f5c1a8653ab2",
              "versionType": "git"
            },
            {
              "lessThan": "8740156ad33be5071b588b594c55f279457f667c",
              "status": "affected",
              "version": "950ad93df2fce70445e655ed2e74f5c1a8653ab2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/cpumask.c",
            "tools/sched_ext/include/scx/compat.bpf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Require a BPF cpumask for bpf_cpumask_populate()\n\nbpf_cpumask_populate() writes to its destination with bitmap_copy(), but\nthe destination is typed as struct cpumask *. That allows the verifier to\naccept borrowed cpumask pointers returned by read-only kfuncs, such as\nscx_bpf_get_online_cpumask(), as a writable destination.\n\nMake the destination a struct bpf_cpumask * so populate follows the same\nownership rule as the other mutating cpumask kfuncs. Query kfuncs continue\nto accept const struct cpumask * inputs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - bpf_cpumask_populate() is a kfunc on BPF_PROG_TYPE_SYSCALL/TRACING/STRUCT_OPS programs loaded via bpf(BPF_PROG_LOAD); the src bitmap is program-local memory, and a SYSCALL program runs it through BPF_PROG_TEST_RUN (bpf_prog_test_run_syscall). Those bits do not arrive in a network protocol message.\nAC:L - A program can call scx_bpf_get_online_cpumask() then bpf_cpumask_populate() in one path; process_kf_arg_ptr_to_btf_id() does not require strict matching here, so the borrowed struct cpumask * is accepted and bitmap_copy() runs with no race or layout dependency.\nPR:L - bpf_prog_load() of BPF_PROG_TYPE_SYSCALL needs only bpf_token_capable(CAP_BPF) (SYSCALL is not in is_perfmon_prog_type); TRACING/STRUCT_OPS also need CAP_PERFMON. bpf_token_capable() checks token-\u003euserns, so a delegated BPF token grants this to userns root rather than init-namespace root.\nUI:N - The attacker loads their own program and either BPF_PROG_TEST_RUN it or fork() to fire their tp_btf/task_newtask hook; no other user must mount, open a file, or otherwise interact.\nS:U - bitmap_copy() overwrites host kernel objects (__cpu_online_mask from scx_bpf_get_online_cpumask(), or task_struct.cpus_mask via cpus_ptr) in the same kernel; this is not a KVM/Xen escape or IOMMU bypass.\nC:N - bpf_cpumask_populate() only bitmap_copy()s the caller-supplied src buffer into the destination mask; it does not read kernel memory back to the program or otherwise disclose confidential data.\nI:H - The destination was typed struct cpumask * rather than struct bpf_cpumask *, so bitmap_copy() writes attacker-controlled bits into borrowed kernel masks such as cpu_online_mask from scx_bpf_get_online_cpumask() or task-\u003ecpus_ptr, which bpf_cpumask_set_cpu() would reject.\nA:H - Overwriting writable __cpu_online_mask forges the set walked by for_each_online_cpu(), so the scheduler IPIs or indexes per-CPU state for offline CPUs or sees num_online_cpus()==0, causing a kernel oops or hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:56:00.309Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0cfc9348a045da64955af2dd6902e66dfc7d6469"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7e2a5c6519adc73be55c3de2cb545e095a0fbc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/8740156ad33be5071b588b594c55f279457f667c"
        }
      ],
      "title": "bpf: Require a BPF cpumask for bpf_cpumask_populate()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93112",
    "datePublished": "2026-09-17T16:11:21.122Z",
    "dateReserved": "2026-09-17T16:02:15.086Z",
    "dateUpdated": "2026-09-18T17:56:00.309Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93112",
      "date": "2026-09-25",
      "epss": "0.00169",
      "percentile": "0.05502"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/cpumask.c",
                  "tools/sched_ext/include/scx/compat.bpf.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0cfc9348a045da64955af2dd6902e66dfc7d6469",
                    "status": "affected",
                    "version": "950ad93df2fce70445e655ed2e74f5c1a8653ab2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b7e2a5c6519adc73be55c3de2cb545e095a0fbc5",
                    "status": "affected",
                    "version": "950ad93df2fce70445e655ed2e74f5c1a8653ab2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8740156ad33be5071b588b594c55f279457f667c",
                    "status": "affected",
                    "version": "950ad93df2fce70445e655ed2e74f5c1a8653ab2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/cpumask.c",
                  "tools/sched_ext/include/scx/compat.bpf.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.15"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Require a BPF cpumask for bpf_cpumask_populate()\n\nbpf_cpumask_populate() writes to its destination with bitmap_copy(), but\nthe destination is typed as struct cpumask *. That allows the verifier to\naccept borrowed cpumask pointers returned by read-only kfuncs, such as\nscx_bpf_get_online_cpumask(), as a writable destination.\n\nMake the destination a struct bpf_cpumask * so populate follows the same\nownership rule as the other mutating cpumask kfuncs. Query kfuncs continue\nto accept const struct cpumask * inputs."
          }
        ],
        "id": "CVE-2026-93112",
        "lastModified": "2026-09-18T18:18:21.150",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:18:05.687",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0cfc9348a045da64955af2dd6902e66dfc7d6469"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8740156ad33be5071b588b594c55f279457f667c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b7e2a5c6519adc73be55c3de2cb545e095a0fbc5"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.