CVE-2026-93112

What it actually does

The verifier incorrectly accepts const struct cpumask * pointers returned by read-only kfuncs as valid writable destinations for bpf_cpumask_populate(), which internally performs bitmap_copy() and violates intended ownership rules for mutating cpumask operations.

Why it matters to the business

Local processes with BPF privileges can corrupt kernel scheduler data structures, leading to system instability, denial of service, or unauthorized modification of CPU mask state without requiring elevated privileges beyond normal BPF access.

How an attack unfolds

An attacker loads a BPF program that obtains a read-only cpumask via a query kfunc such as scx_bpf_get_online_cpumask(), passes it to bpf_cpumask_populate(), and triggers bitmap_copy() writes into memory the verifier should have treated as immutable, bypassing the intended const protection.

How to fix it

Update the Linux kernel to a version containing the upstream fix that changes the destination parameter of bpf_cpumask_populate() to struct bpf_cpumask *.

How to confirm the fix worked

Confirm the kernel source contains the corrected function signature requiring struct bpf_cpumask * for the destination argument and that the verifier enforces ownership rules for mutating cpumask kfuncs.

Typical attack path

1. Obtain a read-only cpumask pointer from a query kfunc
2. Invoke bpf_cpumask_populate() on that pointer
3. Trigger bitmap_copy() write into protected kernel memory
4. Observe or induce scheduler or cpumask corruption effects

How to detect it

Review kernel audit logs and BPF verifier logs for programs attempting to pass const cpumask pointers to mutating kfuncs; look for crashes or scheduler anomalies following BPF program loads that reference cpumask operations.

What your security team should do

• Prioritize kernel upgrades on systems exposing BPF to untrusted local users
• Audit custom BPF programs that interact with cpumask kfuncs for use of read-only pointers with mutating operations
• Monitor for local privilege-escalation or stability issues on BPF-enabled workloads until patched