From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AC2A0584974 for ; Fri, 11 Sep 2026 19:57:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156640; cv=none; b=DCFGHscD0HKtCgG9V6o67nsWdt5yXdv9+3GGjEUxYUBkjDeF9wOgo+C8rbeQHjZap/zTwHFx2SiaXloyNv2ieWthE7AoTYJWFQTZz5qb4gVU8uWZrSkU65877O6gk+ORQtGyTQ0nit0QoY6kSx+9PnT+lYz61bN13a7rt40uA/o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156640; c=relaxed/simple; bh=56uHw/dM7VvkwGH1OQ+EaocPWZJDhQBs/fH2vCUlGso=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=VzTa+0tb3sACGBFSVt+5rNLWzB95Y+2+gG+zv+s0ELEqXuZh7+ANeEm3jtF5HAGCZOuoHWAC6LB7IMCANm0ANcWlnzyRm8SClOmEjKW1saDdXwLn0zg4BbPUzMCf2rsCczwDuCBk9gekfgJdOIoNxhZleJeBhkeLOCCwU1eH5wo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=KsOlRbwa; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="KsOlRbwa" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 41DA91F00899; Fri, 11 Sep 2026 19:57:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789156624; bh=7sZMj7oFhz6pk0RGexTUqQHSPcj3zjEaCn8yAsxvE28=; h=From:To:Cc:Subject:Date:Reply-To; b=KsOlRbwaFgCKR45nYLQA3m69U9c83Pa343twnA6LfHD7y2tmRGuN/TvRkR0ckiXTF dnbnpmn9QzhPLiEtdxHxXTYGlYEbatgi8SGjyabBCHBuNVcXsRb+/HRZ8OtByA0WeV ccizfofrm5Mnyi97+PYghXf7rmFyd247Gg1IfTFA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89579: bpf: Harden bloom filter sizing and indexing on 32-bit kernels Date: Fri, 11 Sep 2026 21:44:28 +0200 Message-ID: <2026091128-CVE-2026-89579-0f65@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3778; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=3TFNjDiJZOrQw2c76gjHYk1VZ+oirrGVTSaaUB3/6r8=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlLIjOW3KiY9GSpY/T2qgsmd75GCjg8try7KX7qzmN8T DYbngv0dsSyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEyh4xLJj/o4IzqOanCG97 ge2DqCcd0y/sOMyw4OTrG1Zv9t66+eLQz5vBZisCxb5b9QMA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloom_map_alloc() has two 32-bit-specific problems when the computed bitmap reaches the U32_MAX fallback case. First, BITS_TO_BYTES(U32_MAX) is evaluated with 32-bit arithmetic. The addition performed by DIV_ROUND_UP wraps, so the map allocates only the fixed-size bloom filter object while keeping bitset_mask == U32_MAX. Subsequent updates can then write past the allocated object. Second, fixing only the allocation size is not sufficient. The bloom hash is a u32, but set_bit() takes a signed long bit number and x86 test_bit() eventually feeds the index to variable_test_bit(long, ...). On 32-bit kernels, hashes in [0x80000000, U32_MAX] therefore become negative bit offsets. x86 bt/bts with a memory operand interpret those offsets relative to the supplied base, so a map with bitset_mask == U32_MAX can read or write before bloom->bitset even after allocating the full 512 MiB bitmap. Keep the U32_MAX fallback, but split each hash into a word pointer and an in-word bit number before calling test_bit() or set_bit(). The bitops argument is then always in [0, BITS_PER_LONG - 1], while BIT_WORD(h) still selects the intended word in the full bitmap. Compute the bitset size from (u64)bitset_mask + 1 before passing the final size to bpf_map_area_alloc(). This fixes the original under-allocation and keeps the allocated storage consistent with the addressable bitset. Exploitation note: local privilege escalation is possible on a 32-bit x86 kernel using the under-allocation bug from a binary with CAP_BPF. The Linux kernel CVE team has assigned CVE-2026-89579 to this issue. Affected and fixed versions =========================== Issue introduced in 5.16 with commit 9330986c03006ab1d33d243b7cfe598a7a3c1baa and fixed in 6.12.109 with commit 3b7a13eccfcf97714ffc1ca6aa663d66d4a30e29 Issue introduced in 5.16 with commit 9330986c03006ab1d33d243b7cfe598a7a3c1baa and fixed in 6.18.50 with commit 272fcb4ba6fab678db0eb966dc81c4c804bef64a Issue introduced in 5.16 with commit 9330986c03006ab1d33d243b7cfe598a7a3c1baa and fixed in 7.2.4 with commit dff481e12b3f127739f6a4ea7cef2c25dc12e056 Issue introduced in 5.16 with commit 9330986c03006ab1d33d243b7cfe598a7a3c1baa and fixed in 7.3-rc1 with commit 11c1e836710dcba03e50454a4eedfdbaf8d3050e Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89579 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: kernel/bpf/bloom_filter.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3b7a13eccfcf97714ffc1ca6aa663d66d4a30e29 https://git.kernel.org/stable/c/272fcb4ba6fab678db0eb966dc81c4c804bef64a https://git.kernel.org/stable/c/dff481e12b3f127739f6a4ea7cef2c25dc12e056 https://git.kernel.org/stable/c/11c1e836710dcba03e50454a4eedfdbaf8d3050e