CVE-2026-90306: ARM: 9481/2: breakpoint: CFI breakpoints only on demand
In the Linux kernel, the following vulnerability has been resolved:
ARM: 9481/2: breakpoint: CFI breakpoints only on demand
This removes the stub hwbreakpointcfihandler() from ARM, making it not steal breakpoint type 0x03 (ARMENTRYCFIBREAKPOINT) unless CFI is actively used in the kernel.
When not instrumenting with CFI, or when a breakpoint is issued in userspace, we fall through to return 1 from hwbreakpointpending() "unhandled fault" so userspace can make use of this breakpoint.
Tested with LKDTM and this command line: echo CFIFORWARDPROTO > /sys/kernel/debug/provoke-crash/DIRECT still works as expected.
Affected Software
Event History
Frequently Asked Questions
Which systems are affected by the breakpoint-handling behavior?
The change applies to ARM Linux kernel systems. It is relevant when CFI is not being used to instrument the kernel, or when breakpoint type 0x03 (ARM_ENTRY_CFI_BREAKPOINT) is issued from userspace.
What behavior should be expected after applying the fix?
The kernel no longer claims breakpoint type 0x03 through the ARM CFI handler unless CFI is actively used. Otherwise, the breakpoint is treated as unhandled by hw_breakpoint_pending(), allowing userspace to use that breakpoint type.