CVE-2026-93135 PUBLISHED

bpf: Reject programs with inlined helpers if JIT is not available

Assigner: Linux
Reserved: 17.09.2026 Published: 17.09.2026 Updated: 17.09.2026

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject programs with inlined helpers if JIT is not available

When an architecture (such as LoongArch, ARM64, and RISC-V) implements bpf_jit_inlines_helper_call(), the verifier skips rewriting the helper call offset (insn->imm) in bpf_do_misc_fixups(). This is because the helper is expected to be inlined by the JIT compiler later. Therefore, insn->imm remains as the raw helper enum ID.

However, if JIT is disabled at runtime (net.core.bpf_jit_enable=0) or if JIT compilation fails dynamically (e.g., due to OOM), the program falls back to the BPF interpreter.

When the interpreter executes (__bpf_call_base + insn->imm) with the unpatched raw ID, it jumps into an invalid address space, triggering an instruction alignment fault or a kernel panic.

Although these helpers have valid C implementations in the kernel, the omission of offset rewriting makes runtime interpreter fallback fatal.

Fix this by setting 'prog->jit_required = 1' when helper call rewriting is skipped for JIT inlining. This ensures that such programs are safely rejected if JIT is not available, preventing the runtime kernel panic.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 2ddec2c80b4402c293c7e6e0881cecaaf77e8cec to 21c6445366795fa3a89954e1d318e7c8afdef843 (excl.)
  • affected from 2ddec2c80b4402c293c7e6e0881cecaaf77e8cec to f1c27922576edccb99d0257827d09bd05c0304a6 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.10 is affected
  • unaffected from 0 to 6.10 (excl.)
  • unaffected from 7.2.6 to 7.2.* (incl.)
  • unaffected from 7.3-rc1 to * (incl.)

References