HIGH Introduced in 7.0
loongarch-bpf ArenaSlot Corruption
CVE-2026-89905
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Move arena register slot below TCC context Currently, the stack layout places the optional arena register slot above the tail call counter context. When arena_vm_start is dynamically enabled, it shifts the relative offset of the tcc_ptr slot within the stack frame, causing hardcoded tracking macros to mismatch and leading to memory misalignment or corruption potentially. To fix this, move the arena register save and restore sequences below the tail call counter context slots in both build_prologue() and the epilogue. Update __build_epilogue() to insert a proper offset decrement to safely skip the unneeded tcc_ptr reading block while accurately aligning with the relocated arena slot at the very bottom. With this patch, the tcc_ptr slot is always positioned at a fixed distance directly underneath the base callee-saved registers that is independent of whether the arena features are on.
02KernelScan AI Analysis
Risk summary
A stack layout bug in the LoongArch BPF JIT compiler causes generated BPF code to access incorrect stack offsets when the arena feature is enabled, leading to kernel memory corruption. Any local process with the ability to load BPF programs can trigger this, potentially achieving arbitrary kernel read/write or causing a system crash. The impact is limited to LoongArch systems running kernels that include the PROBE_MEM32 arena support.
Vulnerability analysis
The LoongArch BPF JIT compiler places an optional arena register save slot above the tail call counter context in the generated program's stack frame. When the arena feature is dynamically enabled, this extra slot shifts the tail call counter pointer to a different offset than the hardcoded tracking macros expect, so the JIT'd code reads and writes at wrong stack locations—corrupting kernel memory. The fix moves the arena register save and restore below the tail call counter slots in both the prologue and epilogue, ensuring the counter slot is always at a fixed offset from the callee-saved registers regardless of whether arena is enabled. The epilogue is also adjusted to correctly skip the now-relocated arena slot. This vulnerability is reachable locally by any process that can load BPF programs, which requires CAP_BPF on most distributions, and only affects LoongArch systems with the PROBE_MEM32 arena feature compiled in.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.0 | 7.2.5 | f0e4d069cb47 |
| mainline | 7.0 | 7.3 | cd7e356b07a2 |