Copyright © 2012 Red Hat, Inc. All rights reserved.
Moderate
2026-06-24T00:00:00
kernel: bpf: Fix abuse of kprobe_write_ctx via freplace
6.4
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-94
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix abuse of kprobe_write_ctx via freplace
uprobe programs are allowed to modify struct pt_regs.
Since the actual program type of uprobe is KPROBE, it can be abused to
modify struct pt_regs via kprobe+freplace when the kprobe attaches to
kernel functions.
For example,
SEC("?kprobe")
int kprobe(struct pt_regs *regs)
{
return 0;
}
SEC("?freplace")
int freplace_kprobe(struct pt_regs *regs)
{
regs->di = 0;
return 0;
}
freplace_kprobe prog will attach to kprobe prog.
kprobe prog will attach to a kernel function.
Without this patch, when the kernel function runs, its first arg will
always be set as 0 via the freplace_kprobe prog.
To fix the abuse of kprobe_write_ctx=true via kprobe+freplace, disallow
attaching freplace programs on kprobe programs with different
kprobe_write_ctx values.
A flaw was found in the Linux kernel. This vulnerability allows for the abuse of the `kprobe_write_ctx` mechanism through `freplace` in Berkeley Packet Filter (BPF) kprobe programs. A local attacker could exploit this by attaching a `freplace` program to a `kprobe` program that is attached to a kernel function. This could lead to the modification of the kernel function's arguments, specifically setting the first argument to zero, potentially causing unexpected system behavior or impacting data integrity.
This CVE has been rated as Moderate because eBPF (and XDP) is restricted to root-only on Red Hat Enterprise Linux.
Red Hat Enterprise Linux 10
Not affected
kernel
Red Hat Enterprise Linux 6
Not affected
kernel
Red Hat Enterprise Linux 7
Not affected
kernel
Red Hat Enterprise Linux 7
Not affected
kernel-rt
Red Hat Enterprise Linux 8
Not affected
kernel
Red Hat Enterprise Linux 8
Not affected
kernel-rt
Red Hat Enterprise Linux 9
Not affected
kernel
Red Hat Enterprise Linux 9
Not affected
kernel-rt
https://www.cve.org/CVERecord?id=CVE-2026-53095
https://nvd.nist.gov/vuln/detail/CVE-2026-53095
https://lore.kernel.org/linux-cve-announce/2026062410-CVE-2026-53095-5229@gregkh/T