CVE-2026-93125

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

check_kfunc_args() takes the oversized rdonly_buf_size/rdwr_buf_size from the BPF program's own constant (reg->var_off.value) on the local bpf(BPF_PROG_LOAD) path (bpf_prog_load → bpf_check → check_kfunc_call). That immediate is not a field of a received packet or a ksmbd/nfsd message.

AC:LAttack complexity, low

The attacker picks a 64-bit immediate with upper bits set (e.g. ~0ULL as in hid_rdesc_fixup_get_data_overflow) as the rdonly_buf_size/rdwr_buf_size argument; tnum_is_const succeeds and regs[BPF_REG_0].mem_size = meta.r0_size truncates deterministically, with no race or layout outside their control.

PR:LPrivileges required, low

do_check_common() rejects BPF_PSEUDO_KFUNC_CALL unless env->bpf_capable, which bpf_check() sets from bpf_token_capable(token, CAP_BPF). CAP_BPF is a reduced capability and is delegable into a user namespace via a BPF token, so init-namespace root is not required.

UI:NUser interaction, none

The attacker loads the crafted program with bpf(BPF_PROG_LOAD) and runs it themselves via BPF_PROG_TEST_RUN or by attaching their own HID-BPF/io_uring struct_ops. No separate victim action such as mounting an image is required.

S:UScope, unchanged

The truncated PTR_TO_MEM mem_size lets the verified program read and write host kernel memory, which is a standard kernel privilege escalation in the same authority. It does not cross a KVM/Xen, IOMMU, or guest-to-host boundary.

C:HConfidentiality impact, high

check_kfunc_call() copies the truncated r0_size into a PTR_TO_MEM register, so check_mem_region_access() allows loads of up to ~4 GiB. bpf_kfunc_call_test_get_rdonly_mem takes const int rdonly_buf_size: a value such as 0x1FFFFFFFF becomes -1, the size > 8 check fails open, and the 8-byte prog_test_ref_kfunc is treated as a 4 GiB readable buffer.

I:HIntegrity impact, high

rdwr_buf_size kfuncs (bpf_kfunc_call_test_get_rdwr_mem, hid_bpf_get_data, bpf_io_uring_get_region) mark R0 as writable PTR_TO_MEM. The same truncated mem_size lets check_mem_region_access() accept stores past the real object, which is an arbitrary kernel write.

A:HAvailability impact, high

Those verifier-allowed out-of-bounds loads and stores overrun the kfunc's actual object (prog_test_struct from get_mem, hid_bpf_get_data's ctx_kern->data, or an io_uring mapped region) and can oops or panic the kernel.