---
id: CVE-2026-93125
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max

  check_kfunc_args() detects a kfunc argument named rdonly_buf_size or
  rdwr_buf_size and stores reg-…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max

  check_kfunc_args() detects a kfunc argument named rdonly_buf_size or
  rdwr_buf_size and stores reg-…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= eb1f7f71c126c8fd50ea81af98f97c4b581ea4ae <
    56a3846830ac95a472297d0cbba75cbff29540bb
  - >-
    Linux >= eb1f7f71c126c8fd50ea81af98f97c4b581ea4ae <
    2aaf67f0516fde29620d0edfc29c01b9ea7ad430
  - Linux 6.1
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:18:21.907'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93125'
references:
  - url: 'https://git.kernel.org/stable/c/2aaf67f0516fde29620d0edfc29c01b9ea7ad430'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/56a3846830ac95a472297d0cbba75cbff29540bb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00165
epssPercentile: 0.05081
ingestedAt: '2026-09-17T16:21:47.749Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max

check_kfunc_args() detects a kfunc argument named rdonly_buf_size or
rdwr_buf_size and stores reg->var_off.value into meta->r0_size, a u64,
and does not bound it. check_kfunc_call() later copies that value into
the returned register's mem_size field:

  meta->r0_size = reg->var_off.value;
  ...
  regs[BPF_REG_0].mem_size = meta.r0_size;

regs[BPF_REG_0].mem_size is u32. A constant whose upper 32 bits are set
gets truncated instead of causing a load-time rejection, so the verifier
records a PTR_TO_MEM register with an approximately 4 GiB mem_size for
whatever allocation the kfunc returned. A later access check against
that register uses the truncated, wrong bound.

Reject rdonly_buf_size/rdwr_buf_size values that exceed U32_MAX at the
point meta->r0_size is set.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.