Linux Kernel EUVD-2026-55396

Exploitation requires three simultaneous conditions: (1) the target system must be running on LoongArch hardware with the BPF JIT enabled (net.core.bpf_jit_enable != 0, which is typically the default when JIT-compiled kernels include LoongArch BPF support); (2) the attacker must have the ability to load BPF programs, which on most distributions requires either kernel.unprivileged_bpf_disabled=0 (allowing any user) or CAP_BPF/CAP_NET_ADMIN capability; (3) the BPF program must execute signed ALU32 BPF_DIV or BPF_MOD instructions (off=1) with operands that produce a negative 32-bit quotient or remainder, triggering the incorrect sign-extension path. Unsigned ALU32 div/mod and all other ALU32 operations are NOT affected. Systems on x86, ARM64, RISC-V, MIPS, or any non-LoongArch architecture are entirely unaffected regardless of kernel version.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 High, indicating local access with low privileges is sufficient and the full CIA impact is plausible - consistent with the privilege-escalation threat class of eBPF JIT/verifier divergences. Against this, EPSS at 0.19% (9th percentile) signals very low exploitation probability in the near term, and there is no CISA KEV entry. The architecture specificity is a critical risk-limiting factor: LoongArch is a MIPS-derived RISC architecture primarily deployed in Chinese-manufactured Loongson systems, representing a small fraction of global Linux deployments. JIT/verifier divergences of this class (e.g., CVE-2021-3490, CVE-2022-23222) have historically been exploited for local privilege escalation on mainstream architectures, so the exploitation pathway is well-understood - the barrier here is primarily the niche architecture rather than technical difficulty. The tag 'Information Disclosure' from available intelligence understates the risk; the CVSS C:H/I:H/A:H profile is consistent with full privilege escalation. Net assessment: high theoretical severity for LoongArch deployments with unprivileged BPF enabled, but limited real-world population makes this a medium operational priority. CVSS scope (S:U) is appropriate if the JIT divergence is exploited to read kernel memory without achieving scope change, though full kernel compromise would warrant S:C - this is an uncertainty in the assessment.

A local user with low-privileged access on a LoongArch Linux system writes a crafted eBPF program that performs signed 32-bit division or modulo operations whose quotients or remainders are negative, then loads it via a BPF syscall. The verifier analyzes the program assuming ALU32 upper bits are zero post-operation, but the JIT-compiled native code leaves bits 63:32 set, creating register state the verifier never accounted for. The attacker uses this semantic gap - for example, by exploiting pointer arithmetic or type confusion that the verifier incorrectly considered safe - to read or write kernel memory and escalate privileges. No public exploit is confirmed at time of analysis, but the exploitation technique is well-documented in prior eBPF JIT/verifier divergence research.