CVE-2026-80865

What it actually does

Missing access_ok validation before __get_user on a user-space pointer array in the BPF copy_user_syms function allows the kernel to attempt access to unvalidated user memory.

Why it matters to the business

Low-likelihood exposure in Linux environments using BPF that could lead to kernel instability or crashes; no known active exploitation increases operational risk but does not require emergency response.

How an attack unfolds

An attacker would craft input that reaches copy_user_syms with an invalid user pointer array, relying on the absent access_ok check to trigger unsafe __get_user operations during symbol resolution.

How to fix it

Apply the upstream kernel patch that adds the missing access_ok call for the pointer array and removes the unnecessary error check in the error path; rebuild and deploy updated kernels across affected systems.

How to confirm the fix worked

Confirm the presence of the access_ok call before the __get_user loop in copy_user_syms and verify that kvmalloc_array failures return -ENOMEM directly; test with crafted user pointers to ensure validation occurs.

Typical attack path

1. Identify or create a code path that invokes copy_user_syms with a user-controlled pointer array
2. Supply an unvalidated or invalid user-space address
3. Trigger the __get_user calls without prior access_ok check
4. Observe resulting kernel behavior such as faults or information exposure

How to detect it

Examine kernel logs for unexpected faults or warnings originating from copy_user_syms or related BPF symbol functions; review audit trails around BPF program loads for anomalous pointer values.

What your security team should do

• Prioritize kernel updates on systems with heavy BPF usage within standard patch cycles
• Monitor upstream stable branches for the merged fix
• Review BPF program loaders for any custom symbol handling that might interact with this path