CVE-2026-93270: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disallow interpreter fallback for BPFADDRPERCPU insn
The BPFMOV64PERCPUREG insn requires JIT to emit native code to for 'dstreg = srcreg + <percpubaseoff>'.
However, the interpreter ignores the 'off' at its ALU64MOVX label. The 'off' indicates the insn is BPFMOV64PERCPUREG insn. Then, when the interpreter loads memory from the register, it will hit a page fault.
[ 2.545572] BUG: unable to handle page fault for address: ffffffffacaaf034 [ 2.546485] #PF: supervisor read access in kernel mode [ 2.547167] #PF: errorcode(0x0000) - not-present page [ 2.547850] PGD 134e63067 P4D 134e63067 PUD 134e64063 PMD 10021c063 PTE 800ffffeca550062 [ 2.548912] Oops: Oops: 0000 [#1] SMP PTI
Set jitrequired as true in order to disallow interpreter fallback in core.c::bpfprogselectruntime(), if any BPFADDRPERCPU insn is patched to the prog.
BTW, rename the helper bpfmapsupportscpuflags() to bpfmapispercpumap().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set jit_required to true for programs containing a BPF_ADDR_PERCPU instruction to disallow interpreter fallback and require JIT compilation.
Linux kernel BPF jit_required = true
Event History
Frequently Asked Questions
Under what conditions can this issue be triggered?
It requires a BPF program containing a BPF_MOV64_PERCPU_REG instruction, which is identified by the BPF_ADDR_PERCPU offset, to run through the interpreter rather than native JIT-generated code. The interpreter ignores the instruction offset and can subsequently fault when memory is loaded through the resulting register value.
What is the operational impact if an affected program reaches the interpreter?
The kernel can hit a supervisor-mode page fault while loading memory from the register and produce an Oops. The provided trace shows a not-present page fault in kernel mode.
What changes in the resolved code prevent the fault?
The fix marks programs containing a patched BPF_ADDR_PERCPU instruction as requiring JIT, preventing interpreter fallback during runtime selection. This ensures the instruction is handled by native JIT code, which applies the required per-CPU base offset.