CVE-2026-89581: bpf, x86: Fix per-CPU address resolution into an extended register
In the Linux kernel, the following vulnerability has been resolved:
bpf, x86: Fix per-CPU address resolution into an extended register
The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod(), which sets REX.B. REX.B extends ModRM.rm and SIB.base, and this instruction addresses memory as disp32 with no base, so the bit has no effect at all and the high register bit is simply lost.
Every isereg() destination therefore resolves to the wrong register, picking whichever one shares the low three bits:
R5 -> RAX R7 -> RBP R8 -> RSI R9 -> RDI
With BPFREG5, whose reg2hex is 0, the emitted
65 49 03 04 25 <off> add %gs:<off>,%rax
adds the per-CPU offset to RAX rather than R8. The destination keeps the unadjusted address and RAX is clobbered, so the program goes on to dereference a pointer that was never made per-CPU:
BUG: unable to handle page fault for address: 0000607e386a8894 RIP: bpfprog707837aafd2aa9aeupdatepercpudata+0x93/0xc9 Call Trace: bpfprogtestrunrawtp+0x2dc/0x7d0 flushsmpcallfunctionqueue+0x1e9/0xc80 Kernel panic - not syncing: Fatal exception in interrupt
R5 is the mildest of the four, aliasing a scratch register and faulting at the store. R7 aliases RBP and would corrupt the frame pointer, R8 and R9 alias the argument registers.
Use add2mod() so the register goes through REX.R, matching how add2reg() places it in ModRM.reg and how emitprivframeptr() hardcodes 0x4c for the same instruction with R9. Encodings for the non-extended registers are unchanged.
Problem showed up when trying to resurrect BPFGCC CI (selftests built with BPFGCC).
This has gone unnoticed because clang reloads the address into R1 before each per-CPU access, so the destination is never an extended register. GCC keeps several per-CPU addresses live at once, and testprogs-bpfgcc panics the kernel in globalpercpudata/init, where the address of a .percpu variable ends up in R5.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger the fault?
The affected path is reached when x86 BPF code resolves a per-CPU address into an extended-register destination. Destinations identified by is_ereg() can be encoded as the wrong register; the provided example shows BPF_REG_5 causing the per-CPU offset to be added to RAX rather than R8.
What operational impact could indicate this issue is being hit?
The intended destination retains an unadjusted address while RAX is clobbered, so subsequent dereferencing can fault. The reported symptom includes an "unable to handle page fault" message in a BPF program test-run path and can escalate to a kernel panic.
Where are the available fixes referenced?
The supplied references identify stable-tree fixes in commits 638bc3aada8ecdece184d5c15b100d489c9cccd7, 6886642414f59f928728802dc2c972a9859e6310, and 6a19b18d458881bf3269a357cc6dc6db5eef4369.