CVE-2026-92517: bpf, riscv: Fix extable handling for arena load_acquire
In the Linux kernel, the following vulnerability has been resolved:
bpf, riscv: Fix extable handling for arena loadacquire
emitatomicldst() returns 1 to have buildbody() skip the zext after a sub-word loadacquire. The caller does "ret = ret ?: addexceptionhandler(...)", which skips addexceptionhandler() on any non-zero ret, so the extable entry is missing and a faulting PROBEATOMIC loadacquire oopses.
REGDONTCLEARMARKER leaves rd stale on fault, and the verifier still thinks the load overwrote it, so a program can leak it through a map.
Check ret >= 0 before calling addexceptionhandler(), and pass rd for LOADACQ so the fault zeroes rd like a PROBEMEM load. Return ret unchanged for the zext skip.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel systems on RISC-V where an affected BPF program executes a faulting PROBE_ATOMIC sub-word load_acquire operation. The vulnerable path is specific to the RISC-V BPF JIT handling of this operation.
What does an attacker need to trigger the leak?
They need to cause a PROBE_ATOMIC load_acquire to fault in an affected BPF program. On fault, the destination register can retain stale data even though the verifier treats it as overwritten, allowing that data to be leaked through a map.
What is the operational impact of triggering the fault?
The missing exception-table entry causes a faulting PROBE_ATOMIC load_acquire to oops. Separately, stale register contents may be exposed through a BPF map because the destination register is not cleared on the fault path.