CVE-2026-93043: bpf: Disallow interpreter fallback for gotox insn
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disallow interpreter fallback for gotox insn
The interpreter does not recognize the BPFJMP|BPFJA|BPFX insn, which is used for insnarray map. Thereafter, it would hit the BUGON() in bpfprogrun() at run time.
[ 2.563726] BPF interpreter: unknown opcode 0d (imm: 0x0) [ 2.564557] ------------[ cut here ]------------ [ 2.565206] kernel BUG at kernel/bpf/core.c:2349! [ 2.565882] Oops: invalid opcode: 0000 [#1] SMP PTI
Set jitrequired as true when insnarray map is used in the prog in order to disallow interpreter fallback for gotox insn in core.c::bpfprogselectruntime().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set jit_required=true when insn_array map is used in the eBPF program, to disallow interpreter fallback for the gotox insn.
Linux kernel eBPF JIT/interpreter runtime selection (insn_array map / gotox insn) jit_required = true
Event History
Frequently Asked Questions
What conditions are required to trigger the kernel crash?
A BPF program must use an insn_array map, which causes it to contain the BPF_JMP|BPF_JA|BPF_X “gotox” instruction. The problem occurs if that program falls back to the BPF interpreter, because the interpreter does not recognize this opcode.
What is the observable impact on an affected system?
At runtime, the BPF interpreter reports an unknown opcode and reaches a BUG_ON() in ___bpf_prog_run(). This results in a kernel BUG and invalid-opcode Oops.
What mitigation is implemented by the fix?
The fix marks programs using an insn_array map as requiring JIT compilation. This prevents interpreter fallback for programs containing the unsupported gotox instruction.