CVE-2026-92518: riscv, bpf: Fix kernel stack corruption in tailcall with CFI
In the Linux kernel, the following vulnerability has been resolved:
riscv, bpf: Fix kernel stack corruption in tailcall with CFI
When CONFIGCFICLANG is enabled, prog->bpffunc already skips the kcfi instruction during setup. Including it again in the tailcall jump offset causes it to jump over an extra 4 bytes, skipping the stack pointer adjustment, which will result in kernel stack corruption.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are affected by this issue?
The issue applies to Linux kernel builds for RISC-V that use BPF and have CONFIG_CFI_CLANG enabled. The vulnerable condition is in BPF tail-call handling under that configuration.
What condition triggers the corruption?
A BPF tail call must be executed on an affected build. The incorrect tail-call jump offset skips the stack pointer adjustment, resulting in kernel stack corruption.
What should be done to remediate the issue?
Apply the available stable kernel fixes referenced for this CVE. The fix corrects the tail-call jump offset so that the stack pointer adjustment is not skipped.