CVE-2026-89579: bpf: Harden bloom filter sizing and indexing on 32-bit kernels

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bpf: Harden bloom filter sizing and indexing on 32-bit kernels

bloom_map_alloc() has two 32-bit-specific problems when the computed
bitmap reaches the U32_MAX fallback case.

First, BITS_TO_BYTES(U32_MAX) is evaluated with 32-bit arithmetic. The
addition performed by DIV_ROUND_UP wraps, so the map allocates only the
fixed-size bloom filter object while keeping bitset_mask == U32_MAX.
Subsequent updates can then write past the allocated object.

Second, fixing only the allocation size is not sufficient. The bloom hash
is a u32, but set_bit() takes a signed long bit number and x86 test_bit()
eventually feeds the index to variable_test_bit(long, ...). On 32-bit
kernels, hashes in [0x80000000, U32_MAX] therefore become negative bit
offsets. x86 bt/bts with a memory operand interpret those offsets relative
to the supplied base, so a map with bitset_mask == U32_MAX can read or
write before bloom->bitset even after allocating the full 512 MiB bitmap.

Keep the U32_MAX fallback, but split each hash into a word pointer and an
in-word bit number before calling test_bit() or set_bit(). The bitops
argument is then always in [0, BITS_PER_LONG - 1], while BIT_WORD(h) still
selects the intended word in the full bitmap.

Compute the bitset size from (u64)bitset_mask + 1 before passing the final
size to bpf_map_area_alloc(). This fixes the original under-allocation and
keeps the allocated storage consistent with the addressable bitset.

Exploitation note: local privilege escalation is possible on a 32-bit x86
kernel using the under-allocation bug from a binary with CAP_BPF.

The Linux kernel CVE team has assigned CVE-2026-89579 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.16 with commit 9330986c03006ab1d33d243b7cfe598a7a3c1baa and fixed in 6.12.109 with commit 3b7a13eccfcf97714ffc1ca6aa663d66d4a30e29
	Issue introduced in 5.16 with commit 9330986c03006ab1d33d243b7cfe598a7a3c1baa and fixed in 6.18.50 with commit 272fcb4ba6fab678db0eb966dc81c4c804bef64a
	Issue introduced in 5.16 with commit 9330986c03006ab1d33d243b7cfe598a7a3c1baa and fixed in 7.2.4 with commit dff481e12b3f127739f6a4ea7cef2c25dc12e056
	Issue introduced in 5.16 with commit 9330986c03006ab1d33d243b7cfe598a7a3c1baa and fixed in 7.3-rc1 with commit 11c1e836710dcba03e50454a4eedfdbaf8d3050e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89579
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/bpf/bloom_filter.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3b7a13eccfcf97714ffc1ca6aa663d66d4a30e29
	https://git.kernel.org/stable/c/272fcb4ba6fab678db0eb966dc81c4c804bef64a
	https://git.kernel.org/stable/c/dff481e12b3f127739f6a4ea7cef2c25dc12e056
	https://git.kernel.org/stable/c/11c1e836710dcba03e50454a4eedfdbaf8d3050e