CVE-2026-93125

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max

check_kfunc_args() detects a kfunc argument named rdonly_buf_size or

rdwr_buf_size and stores reg->var_off.value into meta->r0_size, a u64,

and does not bound it. check_kfunc_call() later copies that value into

the returned register's mem_size field:

meta->r0_size = reg->var_off.value;

...

regs[BPF_REG_0].mem_size = meta.r0_size;

regs[BPF_REG_0].mem_size is u32. A constant whose upper 32 bits are set

gets truncated instead of causing a load-time rejection, so the verifier

records a PTR_TO_MEM register with an approximately 4 GiB mem_size for

whatever allocation the kfunc returned. A later access check against

that register uses the truncated, wrong bound.

Reject rdonly_buf_size/rdwr_buf_size values that exceed U32_MAX at the

point meta->r0_size is set.