kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs
undesirable out-of-bounds speculation on pointer arithmetic in various
cases, including cases of different branches with different state or limits
to sanitize, leading to side-channel attacks.

Jann Horn discovered that the eBPF implementation in the Linux kernel was
insufficiently hardened against Spectre V1 attacks. A local attacker could
use this to expose sensitive information.

 tyhicks> Mitigation for this vulnerability is available by setting the
  kernel.unprivileged_bpf_disabled sysctl to 1:
  $ sudo sysctl kernel.unprivileged_bpf_disabled=1
  $ echo kernel.unprivileged_bpf_disabled=1 | \
  sudo tee /etc/sysctl.d/90-CVE-2019-7308.conf
 tyhicks> This issue is mitigated on systems that use secure boot, thanks to
  the kernel lockdown feature which blocks BPF program loading.