CVE-2026-63809

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: use kvfree() for replaced sysctl write buffer

proc_sys_call_handler() allocates its temporary sysctl buffer with

kvzalloc() and passes it to __cgroup_bpf_run_filter_sysctl(). Since

kvzalloc() may fall back to vmalloc() for large allocations, freeing

that buffer with kfree() is wrong and can corrupt memory.

Use kvfree() to safely handle both kmalloc and kvzalloc()/vmalloc

allocations.

The bug was first flagged by an experimental analysis tool we are

developing for kernel memory-management bugs while analyzing

v6.13-rc1. The tool is still under development and is not yet publicly

available. Manual inspection confirms that the bug is still

present in v7.1-rc5.

Reproduced the bug based on v7.1-rc4 in a QEMU x86_64 guest booted with

KASAN and CONFIG_FAILSLAB enabled. To exercise the replacement path, the

test tree also included the accompanying fix for the stale ret == 1

check in __cgroup_bpf_run_filter_sysctl().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References