CVE-2026-92485: bpf: Fix WARNING in bpf_tracing_link_release

Published Sep 17, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix WARNING in bpftracinglinkrelease

The trampoline could be corrupted by the blindly 'tr->flags = BPFTRAMPFTAILCALLCTX' in verifier.

1. A fexit attached to a tailcallreachable prog. 'tr->flags' became 'BPFTRAMPFCALLORIG | BPFTRAMPFTAILCALLCTX'. And, the trampoline would poke the target prog's nop insn using jmp insn instead of call insn. 2. Another fexit loaded with the same tailcallreachable prog target. 'tr->flags' became 'BPFTRAMPFTAILCALLCTX'. 3. Close the first fexit link. Due to no BPFTRAMPFCALLORIG in 'tr->flags', the trampoline will fail to restore the prog's nop insn using call insn.

[ 3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpftracinglinkrelease+0x53/0x60, CPU#1: testprogs/98 ... [ 3.428793] bpflinkfree+0x58/0x130 [ 3.429293] bpflinkrelease+0x23/0x30

Fix the warning by updating 'tr->flags' with '|=' and lock.

Affected Software

1 affected component

Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Fix the verifier/warning by updating 'tr->flags' using '|=' and locking so it includes 'BPF_TRAMP_F_CALL_ORIG' along with 'BPF_TRAMP_F_TAIL_CALL_CTX' (instead of only 'BPF_TRAMP_F_TAIL_CALL_CTX').
Linux kernel eBPF trampoline (bpf verifier / bpf_tracing_link_release) tr->flags = tr->flags |= BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX

Event History

Sep 17, 2026

CVE Published

via MITRE·04:10 PM

Data Sourced

via MITRE·04:10 PM

Description

Frequently Asked Questions

What conditions are needed to trigger the warning?

The sequence requires an fexit program attached to a tail-call-reachable program, followed by loading another fexit program with the same target, then closing the first fexit link. This can leave trampoline flags inconsistent and prevent restoration of the target program's nop instruction.

How can I tell whether this has occurred?

The kernel emits a WARNING at bpf_tracing_link_release during release of a BPF tracing link. The reported stack includes bpf_link_free and bpf_link_release, and may identify a test_progs process.