HIGH
bpf Tailcall Corruption
CVE-2026-92518
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix kernel stack corruption in tailcall with CFI When CONFIG_CFI_CLANG is enabled, prog->bpf_func already skips the kcfi instruction during setup. Including it again in the tailcall jump offset causes it to jump over an extra 4 bytes, skipping the stack pointer adjustment, which will result in kernel stack corruption.
02KernelScan AI Analysis
Risk summary
A local attacker who can load BPF programs on a RISC-V 64-bit system with CFI enabled can trigger kernel stack corruption via BPF tailcalls, potentially leading to privilege escalation or a kernel crash. The bug requires CAP_BPF, which on most distributions means a low-privileged local account is the minimum threshold.
Vulnerability analysis
On RISC-V systems with CFI enabled, the BPF compiler miscalculates the jump target for tailcalls. The setup code already skips past a security preamble, but the tailcall logic counts that preamble again, causing the jump to land past the instruction that prepares the kernel stack. This leaves the stack pointer incorrect and corrupts kernel memory each time a tailcall runs. The fix corrects the jump calculation so the tailcall lands where the stack setup occurs. A local user who can load BPF programs — requiring CAP_BPF, or unprivileged BPF if enabled — can trigger this by running a BPF program that uses tailcalls on an affected RISC-V kernel.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | — | 7.3-rc1 | — |
| 6.11 | 6.11.6 | 6.12 | 34b1bb33a025 |
| 7.2 | — | 7.2.6 | 52fb1756ea1d |
| 6.18 | — | 6.18.52 | a6e11a81da34 |