FKIE_CVE-2026-93270

Vulnerability from fkie_nvd - Published: 2026-09-24 16:17 - Updated: 2026-09-24 16:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn The BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for 'dst_reg = src_reg + <percpu_base_off>'. However, the interpreter ignores the 'off' at its ALU64_MOV_X label. The 'off' indicates the insn is BPF_MOV64_PERCPU_REG insn. Then, when the interpreter loads memory from the register, it will hit a page fault. [ 2.545572] BUG: unable to handle page fault for address: ffffffffacaaf034 [ 2.546485] #PF: supervisor read access in kernel mode [ 2.547167] #PF: error_code(0x0000) - not-present page [ 2.547850] PGD 134e63067 P4D 134e63067 PUD 134e64063 PMD 10021c063 PTE 800ffffeca550062 [ 2.548912] Oops: Oops: 0000 [#1] SMP PTI Set jit_required as true in order to disallow interpreter fallback in core.c::__bpf_prog_select_runtime(), if any BPF_ADDR_PERCPU insn is patched to the prog. BTW, rename the helper bpf_map_supports_cpu_flags() to bpf_map_is_percpu_map().
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/57cf929a33cb76be3f24886073ae820b4c496914
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7a0855e73757ee9cf25ba635a1c735018ecba742
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/fixups.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "57cf929a33cb76be3f24886073ae820b4c496914",
              "status": "affected",
              "version": "7bdbf7446305cb65c510c16d57cde82bc76b234a",
              "versionType": "git"
            },
            {
              "lessThan": "7a0855e73757ee9cf25ba635a1c735018ecba742",
              "status": "affected",
              "version": "7bdbf7446305cb65c510c16d57cde82bc76b234a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/fixups.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn\n\nThe BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for\n\u0027dst_reg = src_reg + \u003cpercpu_base_off\u003e\u0027.\n\nHowever, the interpreter ignores the \u0027off\u0027 at its ALU64_MOV_X label.\nThe \u0027off\u0027 indicates the insn is BPF_MOV64_PERCPU_REG insn. Then, when\nthe interpreter loads memory from the register, it will hit a page\nfault.\n\n[    2.545572] BUG: unable to handle page fault for address: ffffffffacaaf034\n[    2.546485] #PF: supervisor read access in kernel mode\n[    2.547167] #PF: error_code(0x0000) - not-present page\n[    2.547850] PGD 134e63067 P4D 134e63067 PUD 134e64063 PMD 10021c063 PTE 800ffffeca550062\n[    2.548912] Oops: Oops: 0000 [#1] SMP PTI\n\nSet jit_required as true in order to disallow interpreter fallback in\ncore.c::__bpf_prog_select_runtime(), if any BPF_ADDR_PERCPU insn is\npatched to the prog.\n\nBTW, rename the helper bpf_map_supports_cpu_flags() to\nbpf_map_is_percpu_map()."
    }
  ],
  "id": "CVE-2026-93270",
  "lastModified": "2026-09-24T16:17:24.020",
  "metrics": {},
  "published": "2026-09-24T16:17:24.020",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/57cf929a33cb76be3f24886073ae820b4c496914"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7a0855e73757ee9cf25ba635a1c735018ecba742"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.