Linux Kernel CVE-2026-93147

Requires the ability to load and execute an eBPF program on an s390x (IBM Z) Linux host - i.e., CAP_BPF (or CAP_SYS_ADMIN on older kernels), so an unprivileged remote path does not apply. Exploitation is further limited to the s390 architecture (the bug is in the s390 BPF JIT emitting the ly instruction for cpu_nr) and to BPF programs that read the current CPU number; on any other architecture or without BPF-load privilege the code path is unreachable. The observable effect is stale upper 32 bits in BPF_REG_0, which bounds the practical impact.

The vendor-assigned CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) overstates the real-world impact of this s390 BPF JIT codegen defect. The vector's local attack vector and PR:L are consistent with the actual precondition - an attacker must be able to load and run an eBPF program on an s390 (IBM Z mainframe) host, which requires CAP_BPF/CAP_SYS_ADMIN. However, the High confidentiality/integrity/availability ratings are not well supported: the bug is that the ly instruction loads the 32-bit cpu_nr into 64-bit BPF_REG_0 without zeroing the upper word (whereas llgf zero-extends), so BPF_REG_0 carries stale/garbage upper bits. The concrete consequence is a wrong 64-bit value in a BPF register - at most a small leak of leftover register contents into the BPF program and/or incorrect downstream computation, not a clear high-impact memory-corruption primitive. No EPSS score, no CISA KEV listing, and no public POC are provided. SSVC-style reading: exploitation is 'none observed', not automatable (requires privileged local BPF load on a niche architecture), and technical impact is partial at best. This is a legitimate correctness fix but a low-priority, low-probability issue in practice - a high-CVSS-but-low-real-risk item, gated by privilege and a rare platform. Realistic severity is closer to ~4.5-5.5.

A local user with CAP_BPF on an IBM Z (s390x) Linux host loads an eBPF program that retrieves the current CPU number; on the JITed s390 code path the upper 32 bits of BPF_REG_0 are not cleared, so the program observes a 64-bit value containing stale kernel register bits and/or uses it in a subsequent computation that misbehaves. No public exploit is identified at time of analysis, and exploitation is confined to the s390 architecture and privileged BPF loading.