EUVD-2026-80502
GHSA-w2c5-6c3v-2hf7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local unprivileged userspace triggers a deterministic break instruction (AV:L/AC:L/PR:L); impact is a bounded cgroup-policy bypass (I:L) and preempt-count instability (A:L), no disclosure (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Avoid preempt count underflow without probe
LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, do_bp() can reach kprobe_singlestep_handler() when there is no current probe.
The handler actually returns false in this case, but it first calls preempt_enable_no_resched(). The corresponding preempt_disable() is done by kprobe_breakpoint_handler() on a real Kprobe hit, so it has not run here. As a result, an ordinary userspace breakpoint (code 11) underflows the current task's preempt count.
This also makes in_interrupt() return true until the task schedules. One visible consequence is the socket cgroup attribution: cgroup_sk_alloc() treats the allocation as interrupt context and assigns the socket to the root cgroup. A socket opened from the SIGTRAP handler can then avoid a BPF_CGROUP_INET_SOCK_CREATE policy attached to the task's own cgroup.
Return as soon as kprobe_running() reports no active probe.
The same check has appeared in [PATCH v10 2/4] of the original LoongArch Kprobes series, but was dropped before the feature reached mainline.
AnalysisAI
A preempt-count underflow in the Linux kernel's LoongArch Kprobes breakpoint handling allows a local, low-privileged user to issue the same break 11 instruction that userspace can generate, driving do_bp() into kprobe_singlestep_handler() with no active probe attached and calling preempt_enable_no_resched() without the matching preempt_disable() that kprobe_breakpoint_handler() would normally have performed. Only LoongArch (loongarch64) kernels with Kprobes enabled are affected-other architectures do not use this break-11 path-and the corrupted preempt state makes in_interrupt() return true until the task reschedules, which causes cgroup_sk_alloc() to attribute new sockets to the root cgroup and can thereby evade a BPF_CGROUP_INET_SOCK_CREATE policy bound to the task's own cgroup. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local code execution on a LoongArch (loongarch64) Linux host running an affected kernel with Kprobes enabled - the flaw is in LoongArch's do_bp()/kprobe_singlestep_handler() break-11 handling and does not exist on other architectures. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world priority is LOW-to-MODERATE despite the vendor CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: apply the LoongArch Kprobes fix available in Linux 6.6.157, 6.12.110, 6.18.51, 7.2.5 and 7.3-rc2 (or any later release containing upstream commit 76395109a051b53860faaec96522ef08ae9e8e27 or its stable backports at https://git.kernel.org/stable/c/c4357ebeee63cb8da1446fc936573a34e68b0f71, https://git.kernel.org/stable/c/ff40e597d5d98c0c45a4d09df8177202fac9520e, https://git.kernel.org/stable/c/a1cb727fa27c2d9c7859729cd90db7bc0f46957f and https://git.kernel.org/stable/c/72ce4b24676e8b3b75376c4c559dd81c1ac52d5a); there is no userspace-side change needed and no configuration toggle that keeps the feature while removing the bug. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all LoongArch (loongarch64) Linux kernel systems with Kprobes enabled and confirm exposure to local low-privileged users; apply the vendor patch (Patch available per vendor advisory) or, if patching cannot be completed immediately, restrict local access and consider disabling Kprobes on affected LoongArch hosts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today