CVE-2023-54181 bpf: Fix issue in verifying allow_ptr_leaks
A flaw in the Linux kernel BPF verifier incorrectly prohibits safe pointer comparisons, preventing legitimate network BPF programs from loading.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-54181?
CVE-2023-54181 is a vulnerability in Linux, published on 30 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix issue in verifying allow_ptr_leaks
After we converted the capabilities of our networking-bpf program from cap_sys_admin to cap_net_admin+cap_bpf, our networking-bpf program failed to start. Because it failed the bpf verifier, and the error log is "R3 pointer comparison prohibited".
A simple reproducer as follows,
SEC("cls-ingress") int ingress(struct __sk_buff *skb) { struct iphdr *iph = (void *)(long)skb->data + sizeof(struct ethhdr);
if ((long)(iph + 1) > (long)skb->data_end) return TC_ACT_STOLEN; return TC_ACT_OK; }
Per discussion with Yonghong and Alexei [1], comparison of two packet pointers is not a pointer leak. This patch fixes it.
Our local kernel is 6.1.y and we expect this fix to be backported to 6.1.y, so stable is CCed.
[1]. https://lore.kernel.org/bpf/CAADnVQ+Nmspr7Si+pxWn8zkE7hX-7s93ugwC+94aXSy4uQ9vBg@mail.gmail.com/
Which versions are affected by CVE-2023-54181?
How do I fix CVE-2023-54181?
Apply the vendor's patch.
Is CVE-2023-54181 being exploited?
There is no known exploitation of CVE-2023-54181 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-54181, DEBIAN-CVE-2023-54181, GHSA-6985-fmpm-h392, ROOT-OS-DEBIAN-11-CVE-2023-54181, ROOT-OS-UBUNTU-2204-CVE-2023-54181, UBUNTU-CVE-2023-54181.