« Volver al listado

CVE-2026-93270

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn

The BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for 'dst_reg = src_reg + <percpu_base_off>'.

However, the interpreter ignores the 'off' at its ALU64_MOV_X label. The 'off' indicates the insn is BPF_MOV64_PERCPU_REG insn. Then, when the interpreter loads memory from the register, it will hit a page fault.

Set jit_required as true in order to disallow interpreter fallback in core.c::__bpf_prog_select_runtime(), if any BPF_ADDR_PERCPU insn is patched to the prog.

Leer descripción completaMostrar menos

BTW, rename the helper bpf_map_supports_cpu_flags() to bpf_map_is_percpu_map().

Detalles técnicos trazas, registros y código del informe original
[    2.545572] BUG: unable to handle page fault for address: ffffffffacaaf034
[    2.546485] #PF: supervisor read access in kernel mode
[    2.547167] #PF: error_code(0x0000) - not-present page
[    2.547850] PGD 134e63067 P4D 134e63067 PUD 134e64063 PMD 10021c063 PTE 800ffffeca550062
[    2.548912] Oops: Oops: 0000 [#1] SMP PTI

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-93270",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7bdbf7446305cb65c510c16d57cde82bc76b234a",
              "lessThan": "57cf929a33cb76be3f24886073ae820b4c496914",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7bdbf7446305cb65c510c16d57cde82bc76b234a",
              "lessThan": "7a0855e73757ee9cf25ba635a1c735018ecba742",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/fixups.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.10",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/fixups.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-24T16:17:24.020",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/57cf929a33cb76be3f24886073ae820b4c496914",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7a0855e73757ee9cf25ba635a1c735018ecba742",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn\n\nThe BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for\n'dst_reg = src_reg + <percpu_base_off>'.\n\nHowever, the interpreter ignores the 'off' at its ALU64_MOV_X label.\nThe 'off' indicates the insn is BPF_MOV64_PERCPU_REG insn. Then, when\nthe interpreter loads memory from the register, it will hit a page\nfault.\n\n[    2.545572] BUG: unable to handle page fault for address: ffffffffacaaf034\n[    2.546485] #PF: supervisor read access in kernel mode\n[    2.547167] #PF: error_code(0x0000) - not-present page\n[    2.547850] PGD 134e63067 P4D 134e63067 PUD 134e64063 PMD 10021c063 PTE 800ffffeca550062\n[    2.548912] Oops: Oops: 0000 [#1] SMP PTI\n\nSet jit_required as true in order to disallow interpreter fallback in\ncore.c::__bpf_prog_select_runtime(), if any BPF_ADDR_PERCPU insn is\npatched to the prog.\n\nBTW, rename the helper bpf_map_supports_cpu_flags() to\nbpf_map_is_percpu_map()."
    }
  ],
  "lastModified": "2026-09-24T16:17:24.020",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}