Linux Kernel CVE-2026-92518

Requires ALL of: (1) a RISC-V Linux kernel, (2) built with CONFIG_CFI_CLANG enabled, (3) a BPF program that uses tail calls, and (4) local ability to load/run that BPF program (typically CAP_BPF/CAP_SYS_ADMIN, matching PR:L). It is NOT remotely exploitable and needs no user interaction, but it is gated by the specific architecture and kernel build option - kernels not built with CFI_CLANG, or non-RISC-V architectures, are not affected by this codepath. Given those preconditions the fault is essentially deterministic.

Signals are consistent for a LOCAL, LOW-severity-in-practice reliability/corruption bug, not a remote priority. The vendor CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8, HIGH), confirming a local attack vector requiring some privilege (PR:L) with no user interaction. There is no EPSS score, no CISA KEV listing, and no public exploit in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The C:H/I:H claim appears overstated: the description describes kernel stack corruption from a JIT codegen offset error (a mis-computed tailcall jump that skips the stack-pointer adjustment), which is a crash/memory-corruption primitive rather than a demonstrated information-disclosure or controlled-write primitive - the real impact is availability (kernel panic/instability). CONFLICT TO VERIFY: the tags label this 'Information Disclosure,' but the description is explicit about 'kernel stack corruption,' which is a denial-of-service/memory-integrity issue, not disclosure. Additionally, CWE is N/A in the input; this maps naturally to CWE-787 (out-of-bounds/stack write) / CWE-662. Real-world risk is low-to-moderate: it is arch- and config-gated (RISC-V builds compiled with CONFIG_CFI_CLANG, using BPF tail calls) and requires the ability to load and run a BPF program locally.

On a RISC-V Linux host built with CONFIG_CFI_CLANG, a local user with BPF-load capability loads and runs a BPF program that performs a tail call; the JIT emits a tailcall jump that double-skips the kcfi instruction, landing 4 bytes past the intended target and skipping the stack-pointer adjustment, corrupting the kernel stack and crashing or destabilizing the kernel. No public exploit code is identified at time of analysis; triggering it is essentially deterministic once the arch/config/tailcall preconditions are met.