KernelScan.io

HIGH

bpf JIT Race

CVE-2026-23383

CVSS 7.8 / 10.0 NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

KernelScan AI7.0HIGH

01

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing struct bpf_plt contains a u64 target field. Currently, the BPF JIT allocator requests an alignment of 4 bytes (sizeof(u32)) for the JIT buffer. Because the base address of the JIT buffer can be 4-byte aligned (e.g., ending in 0x4 or 0xc), the relative padding logic in build_plt() fails to ensure that target lands on an 8-byte boundary. This leads to two issues: 1. UBSAN reports misaligned-access warnings when dereferencing the structure. 2. More critically, target is updated concurrently via WRITE_ONCE() in bpf_arch_text_poke() while the JIT'd code executes ldr. On arm64, 64-bit loads/stores are only guaranteed to be single-copy atomic if they are 64-bit aligned. A misaligned target risks a torn read, causing the JIT to jump to a corrupted address. Fix this by increasing the allocation alignment requirement to 8 bytes (sizeof(u64)) in bpf_jit_binary_pack_alloc(). This anchors the base of the JIT buffer to an 8-byte boundary, allowing the relative padding math in build_plt() to correctly align the target field.

02

Engine v0.2.0

Risk summary

Local attackers with BPF program loading privileges can exploit a race condition in the ARM64 BPF JIT compiler to cause memory corruption and potentially execute arbitrary code. The vulnerability occurs when concurrent updates to misaligned PLT targets result in torn reads during JIT execution, which can crash the system or hijack control flow.

Affectedarch/arm64/net/bpf_jit_comp.c (BPF JIT)

Vulnerability analysis

The root cause is insufficient alignment in BPF JIT buffer allocation on ARM64. The JIT allocator requested only 4-byte alignment, but struct bpf_plt contains a u64 target field that requires 8-byte alignment for atomic operations. When the target field is misaligned, concurrent updates via WRITE_ONCE() in bpf_arch_text_poke() can race with ldr instructions in JIT'd code, causing torn reads where only part of the 64-bit value is updated atomically. This can corrupt the jump target address, leading to control flow hijacking or a kernel panic. The fix increases allocation alignment to 8 bytes (sizeof(u64)), ensuring the PLT target field is properly aligned for atomic 64-bit operations on ARM64.

03

BranchFixed inPatch commit
6.126.12.7780ad264da02c
6.186.18.17519b1ad91de5
6.196.19.766959ed481a4
mainline7.0ef06fd16d487