In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode
syzbot reported uninit memory usages during map_{lookup,delete}_elem.
========== BUG: KMSAN: uninit-value in __dev_map_lookup_elem kernel/bpf/devmap.c:441 [inline] BUG: KMSAN: uninit-value in dev_map_lookup_elem+0xf3/0x170 kernel/bpf/devmap.c:796 __dev_map_lookup_elem kernel/bpf/devmap.c:441 [inline] dev_map_lookup_elem+0xf3/0x170 kernel/bpf/devmap.c:796 ____bpf_map_lookup_elem kernel/bpf/helpers.c:42 [inline] bpf_map_lookup_elem+0x5c/0x80 kernel/bpf/helpers.c:38 ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997 __bpf_prog_run256+0xb5/0xe0 kernel/bpf/core.c:2237 ==========
The reproducer should be in the interpreter mode.
The C reproducer is trying to run the following bpf prog:
0: (18) r0 = 0x0 2: (18) r1 = map[id:49] 4: (b7) r8 = 16777216 5: (7b) *(u64 *)(r10 -8) = r8 6: (bf) r2 = r10 7: (07) r2 += -229 ^^^^^^^^^^
8: (b7) r3 = 8 9: (b7) r4 = 0 10: (85) call dev_map_lookup_elem#1543472 11: (95) exit
It is due to the "void *key" (r2) passed to the helper. bpf allows uninit stack memory access for bpf prog with the right privileges. This patch uses kmsan_unpoison_memory() to mark the stack as initialized.
This should address different syzbot reports on the uninit "void *key" argument during map_{lookup,delete}_elem.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.1.97-104.177Upgrade python3-perf-debuginfoUpgrade bpftoolUpgrade kernel-modules-extra-commonUpgrade perfUpgrade kernel-toolsUpgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade kernel-modules-extraUpgrade perf-debuginfoUpgrade kernel-libbpf-develUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade python3-perfUpgrade kernelUpgrade kernel-libbpfUpgrade kernel-debuginfo-common-x86_64 | Feb 17, 2025 | Jul 29, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Aug 7, 2024 | Jul 29, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 29, 2024 |
| Suse | — | Upgrade kernel-symsUpgrade kernel-zfcpdumpUpgrade kernel-docsUpgrade kernel-64kb-develUpgrade kernel-defaultUpgrade reiserfs-kmp-defaultUpgrade kernel-macrosUpgrade kernel-develUpgrade kernel-64kbUpgrade kernel-obs-buildUpgrade kernel-sourceUpgrade kernel-default-devel | Dec 5, 2025 | Dec 5, 2025 |
| Ubuntu | — | Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1017-nvidia-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-generic-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-virtualUpgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1017-nvidia-lowlatency-64kUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1015-oracleUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1013-gkeUpgrade linux-image-generic-lpaeUpgrade linux-image-genericUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1016-azure-fdeUpgrade linux-image-gkeopUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1016-gcpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-awsUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-gcpUpgrade linux-image-6.8.0-48-genericUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-48-lowlatency-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1014-raspiUpgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1017-azureUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1017-azure-fdeUpgrade linux-image-6.8.0-48-lowlatencyUpgrade linux-image-oem-24.04aUpgrade linux-image-kvmUpgrade linux-image-gkeop-6.8Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1017-nvidiaUpgrade linux-image-oracle-64kUpgrade linux-image-azureUpgrade linux-image-6.8.0-1018-awsUpgrade linux-image-6.8.0-1015-oracle-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-48-generic-64kUpgrade linux-image-6.8.0-1017-nvidia-64kUpgrade linux-image-azure-fdeUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1016-oemUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1017-gcpUpgrade linux-image-6.8.0-1016-azureUpgrade linux-image-6.8.0-1014-ibmUpgrade linux-image-raspi | Nov 4, 2024 | Jul 29, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Jul 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub