CVE-2026-93270: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn

Published Sep 24, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

bpf: Disallow interpreter fallback for BPFADDRPERCPU insn

The BPFMOV64PERCPUREG insn requires JIT to emit native code to for 'dstreg = srcreg + <percpubaseoff>'.

However, the interpreter ignores the 'off' at its ALU64MOVX label. The 'off' indicates the insn is BPFMOV64PERCPUREG insn. Then, when the interpreter loads memory from the register, it will hit a page fault.

[ 2.545572] BUG: unable to handle page fault for address: ffffffffacaaf034 [ 2.546485] #PF: supervisor read access in kernel mode [ 2.547167] #PF: errorcode(0x0000) - not-present page [ 2.547850] PGD 134e63067 P4D 134e63067 PUD 134e64063 PMD 10021c063 PTE 800ffffeca550062 [ 2.548912] Oops: Oops: 0000 [#1] SMP PTI

Set jitrequired as true in order to disallow interpreter fallback in core.c::bpfprogselectruntime(), if any BPFADDRPERCPU insn is patched to the prog.

BTW, rename the helper bpfmapsupportscpuflags() to bpfmapispercpumap().

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Set jit_required to true for programs containing a BPF_ADDR_PERCPU instruction to disallow interpreter fallback and require JIT compilation.

    Linux kernel BPF jit_required = true

Event History

Sep 24, 2026
CVE Published
via MITRE·03:52 PM
Data Sourced
via MITRE·03:52 PM
Description
Data Sourced
via NVD·04:17 PM
Description

Frequently Asked Questions

1

Under what conditions can this issue be triggered?

It requires a BPF program containing a BPF_MOV64_PERCPU_REG instruction, which is identified by the BPF_ADDR_PERCPU offset, to run through the interpreter rather than native JIT-generated code. The interpreter ignores the instruction offset and can subsequently fault when memory is loaded through the resulting register value.

2

What is the operational impact if an affected program reaches the interpreter?

The kernel can hit a supervisor-mode page fault while loading memory from the register and produce an Oops. The provided trace shows a not-present page fault in kernel mode.

3

What changes in the resolved code prevent the fault?

The fix marks programs containing a patched BPF_ADDR_PERCPU instruction as requiring JIT, preventing interpreter fallback during runtime selection. This ensures the instruction is handled by native JIT code, which applies the required per-CPU base offset.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203