Linux Kernel CVE-2026-89906

Requires local execution on a LoongArch (Loongson) system running an affected kernel, plus the privilege to load eBPF programs into the kernel JIT - typically CAP_BPF or CAP_SYS_ADMIN, since unprivileged BPF is disabled by default on modern kernels. The flaw is architecture-specific to the LoongArch BPF JIT tail-call path and only manifests when 'extra JIT passes' occur, so it is not a deterministic single-request trigger. Limiting factors: non-x86/non-ARM niche platform, capability-gated BPF loading, and dependence on JIT pass/code-stride conditions rather than fully attacker-controlled input.

This is a high-CVSS-but-low-real-risk issue. The vendor CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is over-scored relative to the described impact. The root cause is a LoongArch BPF JIT miscompilation: the tail-call jump offset is derived from a stale prior-pass code stride, producing wrong branch offsets that manifest as soft lockups (an availability/DoS condition). The description gives no evidence of confidentiality or integrity compromise, so the full C:H/I:H triad in the vendor vector is not supported by the text - the realistic impact is availability. AC:L is also questionable: the bug only surfaces 'under extra JIT passes,' which is a non-trivial, timing/size-estimation-dependent trigger rather than a straightforward one-shot. PR:L (or higher) is defensible because loading BPF programs requires elevated capability (CAP_BPF/CAP_SYS_ADMIN), and unprivileged BPF is disabled by default on most modern kernels. No EPSS score, no KEV listing, and no public POC were provided. The 'Code Injection' tag conflicts with the description - this is a JIT offset miscalculation causing a lockup, not attacker-controlled code execution; treat that signal as unreliable. Net: real-world priority is LOW, driven by DoS on a niche architecture behind a privilege boundary.

A local user with the capability to load eBPF programs on a LoongArch host submits a BPF program containing tail calls that, when JIT-compiled across multiple passes, triggers the stale-stride jump-offset miscalculation and produces wrong branch offsets, causing a kernel soft lockup and denial of service. No public exploit code is identified, and the trigger depends on JIT pass behavior rather than a deterministic single input.