Cloudanix VulnDB

CVE-2026-92515

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how the Linux kernel checks certain data structures lets specially crafted input trigger an internal warning before security checks run.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Other
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Improper initialization of the seen mask in btf_find_struct_field allows duplicate unique fields across nested BTF structs to reach btf_parse_fields and trigger WARN_ON_ONCE before capability checks during map creation.

Why it matters to the business

Kernel log spam, potential instability on systems processing untrusted BTF data, and exposure of an invariant violation that could be used to probe kernel behavior or cause denial of service on affected Linux deployments.

How an attack unfolds

An attacker crafts a BTF object containing nested structs with duplicate unique fields, loads it via the BPF syscall, and causes the kernel to traverse fields without shared uniqueness state, triggering the warning before any capability enforcement occurs.

How to fix it

Update to a Linux kernel containing the fix that initializes the seen mask once in btf_find_field and passes the pointer through all struct, datasec, and nested walks.

How to confirm the fix worked

Confirm the presence of the shared seen-mask initialization in btf_find_field and test that crafted BTF no longer triggers WARN_ON_ONCE during map creation.

Typical attack path

  1. Craft malicious BTF data with duplicate unique fields at different nesting levels
  2. Invoke BPF map creation or BTF load syscall with the crafted data
  3. Trigger recursive field traversal that fails to share the seen mask
  4. Reach btf_parse_fields and hit the WARN_ON_ONCE invariant check

How to detect it

Search kernel logs and audit trails for WARN_ON_ONCE messages originating from btf_parse_fields or btf_find_struct_field during BPF map operations.

What your security team should do

  • Prioritize kernel updates on systems that accept user-supplied BTF
  • Monitor kernel logs for unexpected WARN_ON_ONCE entries related to BTF field parsing
  • Restrict unprivileged BPF access where possible until patched

The record

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve unique-field state across nested structs btf_find_struct_field() initializes a fresh seen mask for every recursive descent. Unique special fields in different levels of the same aggregate therefore do not see one another. The duplicate fields can reach btf_parse_fields(), where they trigger an invariant WARN_ON_ONCE(). A crafted user BTF can consequently trigger the warning before map creation checks capabilities. Initialize the seen mask once in btf_find_field() and pass the same pointer through struct, datasec, and nested-struct walks. This gives the entire field traversal one shared uniqueness state.

Affected packages

Ecosystem Package Introduced Fixed