CVE-2026-93044: bpf: Disallow interpreter fallback for arena-related insns
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disallow interpreter fallback for arena-related insns
Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::bpfprogselectruntime().
Currently, when the interpreter executes the arena ST/LDX/STX insns, it would hit the BUGON() in bpfprogrun() at run time.
[ 2.579196] BPF interpreter: unknown opcode a2 (imm: 0x0) [ 2.579998] ------------[ cut here ]------------ [ 2.580652] kernel BUG at kernel/bpf/core.c:2349! [ 2.581314] Oops: invalid opcode: 0000 [#1] SMP PTI
Set jitrequired as true when arena map is used in the prog to disallow interpreter fallback for arena-related insns.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set jit_required=true when arena map is used in the eBPF prog to disallow interpreter fallback for arena-related ST/LDX/STX insns.
Linux kernel eBPF jit_required = true - Compensating control
Disallow eBPF interpreter fallback for arena-related insns (e.g., ST/LDX/STX) so execution does not reach the BUG_ON() in ___bpf_prog_run() at runtime.
Event History
Frequently Asked Questions
Which systems are exposed to the runtime kernel crash?
Systems are exposed when a BPF program uses an arena map and is allowed to fall back to the BPF interpreter. The interpreter does not support arena-related ST, LDX, and STX instructions.
What happens if the vulnerable execution path is reached?
The interpreter reports an unknown opcode and then reaches a BUG_ON() in ___bpf_prog_run(), causing a kernel BUG with an invalid-opcode Oops.
How can I identify whether this issue has occurred?
Look for kernel logs containing "BPF interpreter: unknown opcode" followed by a kernel BUG at kernel/bpf/core.c:2349 and an invalid-opcode Oops. The example shows opcode a2 for an arena-related instruction.
What is the relevant mitigation if updating is not immediately possible?
Avoid allowing interpreter fallback for BPF programs that use arena maps. The resolved behavior sets jit_required for such programs so arena-related instructions cannot be executed by the interpreter.