The Linux kernel BPF verifier previously accepted constant negative offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF accesses due to incomplete checks in __check_buffer_access(). While variable offsets were rejected, constant negative offsets produced by pointer arithmetic passed verification because the verifier only checked instruction offsets, not the updated reg->var_off field. This allowed an eight-byte access starting at a negative offset to wrap around, potentially leading to incorrect memory access validation. The fix ensures reg->var_off is constant, calculates the effective access start using signed arithmetic, and rejects accesses with negative starts, thereby preventing this bypass.

This vulnerability could allow BPF programs to bypass verifier checks related to buffer pointer offsets, potentially leading to unsafe memory accesses within the kernel. However, no known exploits are reported in the wild. The impact is limited to the kernel's BPF verifier component and could affect the security of programs relying on BPF for tracing or filtering.

A fix has been implemented in the Linux kernel to reject negative constant offsets for buffer pointers in the BPF verifier. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.