CVE-2026-93135: bpf: Reject programs with inlined helpers if JIT is not available
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject programs with inlined helpers if JIT is not available
When an architecture (such as LoongArch, ARM64, and RISC-V) implements bpfjitinlineshelpercall(), the verifier skips rewriting the helper call offset (insn->imm) in bpfdomiscfixups(). This is because the helper is expected to be inlined by the JIT compiler later. Therefore, insn->imm remains as the raw helper enum ID.
However, if JIT is disabled at runtime (net.core.bpfjitenable=0) or if JIT compilation fails dynamically (e.g., due to OOM), the program falls back to the BPF interpreter.
When the interpreter executes (bpfcallbase + insn->imm) with the unpatched raw ID, it jumps into an invalid address space, triggering an instruction alignment fault or a kernel panic.
Although these helpers have valid C implementations in the kernel, the omission of offset rewriting makes runtime interpreter fallback fatal.
Fix this by setting 'prog->jitrequired = 1' when helper call rewriting is skipped for JIT inlining. This ensures that such programs are safely rejected if JIT is not available, preventing the runtime kernel panic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Set prog->jit_required = 1 when helper call rewriting is skipped for JIT inlining, so programs with inlined helpers are rejected when JIT is unavailable.
Linux kernel BPF verifier prog->jit_required = 1
Event History
Frequently Asked Questions
Which systems are exposed to this failure mode?
Systems are exposed when their architecture implements bpf_jit_inlines_helper_call(), including examples named as LoongArch, ARM64, and RISC-V, and they run BPF programs containing helper calls expected to be inlined by JIT.
What conditions trigger the crash?
The affected BPF program must fall back to the interpreter after helper-call offset rewriting was skipped. This can occur when JIT is disabled at runtime through net.core.bpf_jit_enable=0 or when JIT compilation fails dynamically, such as from out-of-memory conditions.
What is the impact when the vulnerable path is reached?
The interpreter uses an unpatched raw helper ID as an address offset and can jump into invalid address space. This can cause an instruction-alignment fault or a kernel panic.
What mitigation is available if the fix cannot be deployed immediately?
Avoid interpreter fallback for affected programs by keeping BPF JIT available and enabled, and avoid conditions that cause JIT compilation to fail, such as out-of-memory situations. The resolved behavior instead rejects these programs when JIT is unavailable.