---
id: CVE-2023-52928
title: 'bpf: Skip invalid kfunc call in backtrack_insn'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Skip invalid kfunc call in backtrack_insn

  The verifier skips invalid kfunc call in check_kfunc_call(), which
  would be captured in fixup_kfunc_call() if such insn …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e6ac2450d6dee3121cd8bbf2907b78a68a8a353d <
    6e2fac197de2c4c041bdd8982cffb104689113f1
  - >-
    Linux >= e6ac2450d6dee3121cd8bbf2907b78a68a8a353d <
    74eec8266f37aff609db6a2f2b093e56a11c28c4
  - >-
    Linux >= e6ac2450d6dee3121cd8bbf2907b78a68a8a353d <
    d3178e8a434b58678d99257c0387810a24042fb6
  - Linux 5.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:13:55.097270Z'
published: '2025-03-27'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:20:52.893Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-52928'
references:
  - url: 'https://git.kernel.org/stable/c/6e2fac197de2c4c041bdd8982cffb104689113f1'
  - url: 'https://git.kernel.org/stable/c/74eec8266f37aff609db6a2f2b093e56a11c28c4'
  - url: 'https://git.kernel.org/stable/c/d3178e8a434b58678d99257c0387810a24042fb6'
tags:
  - cve.org
epss: 0.0025
epssPercentile: 0.16461
ingestedAt: '2026-11-05T22:38:31.751Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Skip invalid kfunc call in backtrack_insn

The verifier skips invalid kfunc call in check_kfunc_call(), which
would be captured in fixup_kfunc_call() if such insn is not eliminated
by dead code elimination. However, this can lead to the following
warning in backtrack_insn(), also see [1]:

  ------------[ cut here ]------------
  verifier backtracking bug
  WARNING: CPU: 6 PID: 8646 at kernel/bpf/verifier.c:2756 backtrack_insn
  kernel/bpf/verifier.c:2756
	__mark_chain_precision kernel/bpf/verifier.c:3065
	mark_chain_precision kernel/bpf/verifier.c:3165
	adjust_reg_min_max_vals kernel/bpf/verifier.c:10715
	check_alu_op kernel/bpf/verifier.c:10928
	do_check kernel/bpf/verifier.c:13821 [inline]
	do_check_common kernel/bpf/verifier.c:16289
  [...]

So make backtracking conservative with this by returning ENOTSUPP.

  [1] https://lore.kernel.org/bpf/CACkBjsaXNceR8ZjkLG=dT3P=4A8SBsg0Z5h5PWLryF5=ghKq=g@mail.gmail.com/

## Affected

- `Linux >= e6ac2450d6dee3121cd8bbf2907b78a68a8a353d < 6e2fac197de2c4c041bdd8982cffb104689113f1`
- `Linux >= e6ac2450d6dee3121cd8bbf2907b78a68a8a353d < 74eec8266f37aff609db6a2f2b093e56a11c28c4`
- `Linux >= e6ac2450d6dee3121cd8bbf2907b78a68a8a353d < d3178e8a434b58678d99257c0387810a24042fb6`
- `Linux 5.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.