CVE-2026-97420

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: NUL-terminate replaced sysctl value

When writing to sysctls, proc_sys_call_handler() guarantees that the

buffer passed to proc handlers is NUL-terminated. If

bpf_sysctl_set_new_value() replaces the pending sysctl value, it can

hand a replacement buffer directly to proc handlers. However, the

helper currently copies only buf_len bytes into that buffer without

appending a NUL terminator, leaving downstream parsers vulnerable to

out-of-bounds access.

Fix this by appending a '\0' after the replaced value to restore the

expected sysctl semantics. Since the helper already rejects buf_len

greater than PAGE_SIZE - 1, there is always room for the extra byte.

Reproduced in a QEMU x86_64 guest booted with KASAN while exercising

the sysctl replacement path with a cgroup/sysctl BPF program. The

reproducer targets `/proc/sys/net/core/flow_limit_cpu_bitmap`, fills

the original user write buffer with non-zero bytes, and overr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References