CVE-2026-92486: bpf: Fix CFI mismatch in task work callback
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix CFI mismatch in task work callback
BPF subprograms use the bpfcallbackt ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI.
Store and invoke the callback as bpfcallbackt.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are affected by this issue?
Linux kernel systems that use BPF subprograms with task-work callbacks are implicated. The mismatch is specifically detected when kernel Control-Flow Integrity (kCFI) checks the callback invocation.
What conditions are required to trigger the problem?
The affected path requires a BPF subprogram callback to be scheduled and invoked through task work. The issue occurs because task work uses a three-argument function-pointer type while the BPF callback uses the bpf_callback_t ABI.