HIGH
loongarch TailCall Lockup
CVE-2026-89906
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmp_offset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under extra JIT passes. Fix this by calculating the offset directly on the absolute target: "ctx->offset[insn + 1] - ctx->idx". To avoid a false 16-bit range check abort during size estimation, add a "ctx->image == NULL" guard to inject a safe dummy offset.
02KernelScan AI Analysis
Risk summary
A local attacker with BPF loading privileges on a LoongArch system can trigger a kernel soft lockup by loading a BPF program that uses tail calls. The JIT compiler computes incorrect branch offsets during extra compilation passes, causing the generated native code to enter infinite loops and hang the CPU. This is a denial-of-service vulnerability specific to the LoongArch architecture.
Vulnerability analysis
The LoongArch BPF JIT compiler calculates tail-call branch offsets using a macro that derives the jump distance from a stale code stride saved during a prior JIT pass. When the compiler performs extra passes, this stale value produces wrong branch offsets, and the generated native code jumps to incorrect locations—typically creating backward loops that hang the CPU indefinitely. The fix replaces the macro-based calculation with a direct computation from the absolute target instruction index minus the current emit position, ensuring the offset is always correct regardless of which pass is running. A guard is also added so that during the size-estimation pass (when no JIT image buffer exists yet) a safe dummy offset of zero is used, preventing a false range-check failure. The vulnerable code path is reachable by any local user who can load a BPF program with tail calls on a LoongArch system, which requires CAP_BPF or equivalent privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.6 | 6.6.103 | 6.7 | 96f44d493c28 |
| 6.12 | 6.12.43 | 6.13 | 37d545d12f21 |
| 6.15 | 6.15.11 | 6.16 | — |
| 6.16 | 6.16.2 | 6.17 | — |
| 6.18 | — | 6.18.51 | — |
| 7.2 | — | 7.2.5 | — |
| mainline | — | 7.3-rc1 | — |
| 6.1 | 6.1.149 | 6.2 | 882b8912b7e9 |