« Volver al listado

CVE-2026-80865

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

bpf: Add missing access_ok call to copy_user_syms

As reported by sashiko we use __get_user without prior access_ok call on the user space pointer. Adding the missing call for the whole pointer array.

Plus removing the err check in the error path, because it's not needed and also we can return -ENOMEM directly from the first kvmalloc_array fail path.

[1] https://lore.kernel.org/bpf/20260611115503.AC16D1F00893@smtp.kernel.org/

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-80865",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "0236fec57a15dc2a068dfe4488e0c2ab4559b1ec",
              "lessThan": "a67f7f9647cb243b3be32163e88e5bc76e3d51e9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0236fec57a15dc2a068dfe4488e0c2ab4559b1ec",
              "lessThan": "8b719cef5ac30ab83ce5693c5faf10e4944874af",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0236fec57a15dc2a068dfe4488e0c2ab4559b1ec",
              "lessThan": "128391b57e0977c35243672a6f970073651f3831",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0236fec57a15dc2a068dfe4488e0c2ab4559b1ec",
              "lessThan": "0b6252afcd1965f77c6a6f8a802a2e1381822b98",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0236fec57a15dc2a068dfe4488e0c2ab4559b1ec",
              "lessThan": "28ce7bcf8a29aa395b60764df4c97be745de89d0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0236fec57a15dc2a068dfe4488e0c2ab4559b1ec",
              "lessThan": "d5dc200c3a3f217de072af269dd90adddf90e48d",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "kernel/trace/bpf_trace.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.19",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/trace/bpf_trace.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-04T17:16:58.267",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0b6252afcd1965f77c6a6f8a802a2e1381822b98",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/128391b57e0977c35243672a6f970073651f3831",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/28ce7bcf8a29aa395b60764df4c97be745de89d0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8b719cef5ac30ab83ce5693c5faf10e4944874af",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a67f7f9647cb243b3be32163e88e5bc76e3d51e9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d5dc200c3a3f217de072af269dd90adddf90e48d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Add missing access_ok call to copy_user_syms\n\nAs reported by sashiko we use __get_user without prior access_ok call on the\nuser space pointer. Adding the missing call for the whole pointer array.\n\nPlus removing the err check in the error path, because it's not needed and\nalso we can return -ENOMEM directly from the first kvmalloc_array fail path.\n\n[1] https://lore.kernel.org/bpf/20260611115503.AC16D1F00893@smtp.kernel.org/"
    }
  ],
  "lastModified": "2026-09-04T17:16:58.267",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}