Linux Kernel CVE-2026-92485

Requires local privileged access capable of loading and attaching fexit (BPF tracing) programs - effectively CAP_BPF plus CAP_PERFMON - on a kernel built with BPF trampoline support. The specific trigger is attaching an fexit program to a tail_call_reachable target program, then attaching a second fexit to the same target so 'tr->flags' is overwritten to BPF_TRAMP_F_TAIL_CALL_CTX (losing BPF_TRAMP_F_CALL_ORIG), and then releasing the first link. Limiting factors: exploitation is local only (AV:L), needs elevated BPF capabilities (not available to unprivileged users on hardened systems where unprivileged BPF is disabled), and depends on the fexit + tail-call code path rather than any default configuration.

The vendor CVSS is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but the described defect does not support High confidentiality or integrity impact. This is a BPF trampoline flags-corruption bug: the verifier blindly assigns 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' instead of OR-ing, so when a second fexit attaches to the same tail_call_reachable target it drops BPF_TRAMP_F_CALL_ORIG, and closing the first link then fails to restore the target's nop, producing the WARNING at bpf_tracing_link_release and a corrupted trampoline. The realistic outcome is a kernel WARN splat and trampoline/text-patch inconsistency - a stability/DoS-class problem, not information disclosure or arbitrary data modification. AV:L and PR:L are correct: triggering requires the local ability to load and attach fexit BPF programs (CAP_BPF/CAP_PERFMON), which is a privileged, non-default capability. No EPSS score, no CISA KEV entry, and no public POC are provided, so there is no signal of active or imminent exploitation; the git.kernel.org stable references confirm only that a fix is merged. Net: a genuine but locally-scoped, privilege-gated reliability bug - my assessed severity is roughly 5.0, below the vendor's 7.8. Note the input Tags label this 'Information Disclosure', which conflicts with the description (there is no read primitive to userspace) and should be treated as mislabeled.

A local user with BPF privileges (CAP_BPF/CAP_PERFMON) loads a tail_call_reachable program, then attaches two fexit programs to it in sequence so the trampoline flags are overwritten rather than accumulated. Closing the first fexit link leaves the trampoline unable to restore the target's original instruction, tripping a kernel WARNING and leaving text patched inconsistently, which can destabilize the system. No public exploit code is identified at time of analysis.