High · published October 4, 2025
In the Linux kernel, the following vulnerability has been resolved:
bpf: Propagate error from htab_lock_bucket() to userspace
In __htab_map_lookup_and_delete_batch() if htab_lock_bucket() returns
-EBUSY, it will go to next bucket. Going to next bucket may not only
skip the elements in current bucket silently, but also incur
out-of-bound memory access or expose kernel memory to userspace if
current bucket_cnt is greater than bucket_size or zero.
Fixing it by stopping batch operation and returning -EBUSY when
htab_lock_bucket() fails, and the application can retry or skip the busy
batch as needed.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 5.11, < 5.15.75 | 5.15.75 |
| linux/linux_kernel | ≥ 5.16, < 5.19.17 | 5.19.17 |
| linux/linux_kernel | ≥ 6.0, < 6.0.3 | 6.0.3 |