CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix constant blinding for PROBEMEM32 stores
BPFST | BPFPROBEMEM32 immediate stores are not handled by bpfjitblindinsn(), allowing user-controlled 32-bit immediates to survive unblinded into JIT-compiled native code when bpfjitharden >= 1.
The root cause is that convertctxaccesses() rewrites BPFST|BPFMEM to BPFST|BPFPROBEMEM32 for arena pointer stores during verification, before bpfjitblindconstants() runs during JIT compilation. The blinding switch only matches BPFST|BPFMEM (mode 0x60), not BPFST|BPFPROBEMEM32 (mode 0xa0). The instruction falls through unblinded.
Add BPFST|BPFPROBEMEM32 cases to bpfjitblindinsn() alongside the existing BPFST|BPFMEM cases. The blinding transformation is identical: load the blinded immediate into BPFREGAX via mov+xor, then convert the immediate store to a register store (BPFSTX).
The rewritten STX instruction must preserve the BPFPROBEMEM32 mode so the architecture JIT emits the correct arena addressing (R12-based on x86-64). Cannot use the BPFSTXMEM() macro here because it hardcodes BPFMEM mode; construct the instruction directly instead.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.85-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.11-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.80 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.21 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.19.11 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Compensating control
Update bpf_jit_blind_insn() to handle BPF_ST|BPF_PROBE_MEM32 immediate stores alongside BPF_ST|BPF_MEM: load the blinded immediate into BPF_REG_AX via mov+xor, convert the store to BPF_STX, and preserve the BPF_PROBE_MEM32 mode so the architecture JIT emits the correct arena addressing.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23417?
CVE-2026-23417 is classified as a medium severity vulnerability due to potential impacts on data integrity and confidentiality.
How do I fix CVE-2026-23417?
To fix CVE-2026-23417, update your system to the latest version of the Linux kernel that addresses this vulnerability.
What software is affected by CVE-2026-23417?
CVE-2026-23417 affects the Linux kernel and specifically impacts BPF implementations.
What is the impact of CVE-2026-23417?
The impact of CVE-2026-23417 could allow an attacker to control 32-bit immediates used in memory probing, leading to possible misuse.
When was CVE-2026-23417 reported?
CVE-2026-23417 was reported as a vulnerability in the Linux kernel and has been addressed in recent patches.