CVE-2026-93144

What it actually does

The flaw allows non-read accesses through PTR_UNTRUSTED BTF pointers created by helpers such as bpf_rdonly_cast(), bypassing the default read-only policy enforced by the BTF access path.

Why it matters to the business

Local users on affected Linux systems could gain unauthorized write access to kernel structures, leading to potential privilege escalation, data corruption, or system instability.

How an attack unfolds

An attacker with local access loads a BPF program that obtains an untrusted BTF pointer via bpf_rdonly_cast() and then performs writes through it; the check_ptr_to_btf_access() callback incorrectly validates the write before the common rejection logic runs.

How to fix it

Apply the upstream kernel patch that rejects non-read accesses through PTR_UNTRUSTED BTF pointers at the common entry point before any callback branch.

How to confirm the fix worked

Verify the presence of the fix by inspecting the kernel source for the updated check_ptr_to_btf_access() logic or by testing that writes through untrusted BTF pointers are rejected.

Typical attack path

1. Obtain local user access on a Linux system
2. Craft and load a BPF program using bpf_rdonly_cast() to create a PTR_UNTRUSTED pointer
3. Issue a write operation through that pointer inside a program-type btf_struct_access callback
4. Bypass the read-only check and modify kernel memory

How to detect it

Review kernel audit logs and BPF verifier output for unexpected write attempts through BTF pointers; examine system call traces involving bpf() with map or program types that use BTF casting.

What your security team should do

• Prioritize kernel updates on systems that heavily use BPF programs
• Restrict unprivileged BPF loading via sysctl until patched
• Monitor for local privilege-escalation attempts involving BPF