---
id: CVE-2026-80865
title: 'bpf: Add missing access_ok call to copy_user_syms'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Add missing access_ok call to copy_user_syms

  As reported by sashiko we use __get_user without prior access_ok call on the
  user space pointer. Adding the missing c…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0236fec57a15dc2a068dfe4488e0c2ab4559b1ec <
    a67f7f9647cb243b3be32163e88e5bc76e3d51e9
  - >-
    Linux >= 0236fec57a15dc2a068dfe4488e0c2ab4559b1ec <
    8b719cef5ac30ab83ce5693c5faf10e4944874af
  - >-
    Linux >= 0236fec57a15dc2a068dfe4488e0c2ab4559b1ec <
    128391b57e0977c35243672a6f970073651f3831
  - >-
    Linux >= 0236fec57a15dc2a068dfe4488e0c2ab4559b1ec <
    0b6252afcd1965f77c6a6f8a802a2e1381822b98
  - >-
    Linux >= 0236fec57a15dc2a068dfe4488e0c2ab4559b1ec <
    28ce7bcf8a29aa395b60764df4c97be745de89d0
  - >-
    Linux >= 0236fec57a15dc2a068dfe4488e0c2ab4559b1ec <
    d5dc200c3a3f217de072af269dd90adddf90e48d
  - Linux 5.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T17:03:48.253421Z'
published: '2026-09-04'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:55.100Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80865'
references:
  - url: 'https://git.kernel.org/stable/c/a67f7f9647cb243b3be32163e88e5bc76e3d51e9'
  - url: 'https://git.kernel.org/stable/c/8b719cef5ac30ab83ce5693c5faf10e4944874af'
  - url: 'https://git.kernel.org/stable/c/128391b57e0977c35243672a6f970073651f3831'
  - url: 'https://git.kernel.org/stable/c/0b6252afcd1965f77c6a6f8a802a2e1381822b98'
  - url: 'https://git.kernel.org/stable/c/28ce7bcf8a29aa395b60764df4c97be745de89d0'
  - url: 'https://git.kernel.org/stable/c/d5dc200c3a3f217de072af269dd90adddf90e48d'
tags:
  - cve.org
epss: 0.00161
epssPercentile: 0.0529
ingestedAt: '2026-11-06T18:00:12.531Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Add missing access_ok call to copy_user_syms

As reported by sashiko we use __get_user without prior access_ok call on the
user space pointer. Adding the missing call for the whole pointer array.

Plus removing the err check in the error path, because it's not needed and
also we can return -ENOMEM directly from the first kvmalloc_array fail path.

[1] https://lore.kernel.org/bpf/20260611115503.AC16D1F00893@smtp.kernel.org/

## Affected

- `Linux >= 0236fec57a15dc2a068dfe4488e0c2ab4559b1ec < a67f7f9647cb243b3be32163e88e5bc76e3d51e9`
- `Linux >= 0236fec57a15dc2a068dfe4488e0c2ab4559b1ec < 8b719cef5ac30ab83ce5693c5faf10e4944874af`
- `Linux >= 0236fec57a15dc2a068dfe4488e0c2ab4559b1ec < 128391b57e0977c35243672a6f970073651f3831`
- `Linux >= 0236fec57a15dc2a068dfe4488e0c2ab4559b1ec < 0b6252afcd1965f77c6a6f8a802a2e1381822b98`
- `Linux >= 0236fec57a15dc2a068dfe4488e0c2ab4559b1ec < 28ce7bcf8a29aa395b60764df4c97be745de89d0`
- `Linux >= 0236fec57a15dc2a068dfe4488e0c2ab4559b1ec < d5dc200c3a3f217de072af269dd90adddf90e48d`
- `Linux 5.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.