EUVD-2026-80506
GHSA-gpr4-rp6h-2879
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local BPF loading needs a capability (PR:L) and the stale-stride bug requires extra JIT passes (AC:H); impact is a soft lockup (A:H) with only JIT control-flow integrity affected (I:L), no confidentiality.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: BPF: Refactor jump offset calculation in tail call
The old macro-based jmp_offset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under extra JIT passes.
Fix this by calculating the offset directly on the absolute target: "ctx->offset[insn + 1] - ctx->idx".
To avoid a false 16-bit range check abort during size estimation, add a "ctx->image == NULL" guard to inject a safe dummy offset.
AnalysisAI
Incorrect jump-offset calculation in the LoongArch BPF JIT of the Linux kernel can emit wrong tail-call branch targets, causing soft lockups (high availability impact) and, per the assessed vector, limited integrity impact, while confidentiality is unaffected. Affected are LoongArch (Loongson) systems running vulnerable kernel branches including the 6.1.x, 6.6.x, 6.12.x, 6.15.x, 6.16.x and 6.17 lines; exploitation requires local access plus the capability to load eBPF programs into the kernel (CAP_BPF or CAP_SYS_ADMIN, since unprivileged BPF is disabled by default), and only manifests when extra JIT passes occur, so it is not a deterministic single-request trigger. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local execution on a LoongArch (Loongson) system running an affected kernel, plus the privilege to load eBPF programs into the kernel JIT - typically CAP_BPF or CAP_SYS_ADMIN, since unprivileged BPF is disabled by default on modern kernels. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a high-CVSS-but-low-real-risk issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released fix: upgrade to Linux kernel 6.18.51, 7.2.5 or 7.3-rc1, or take the corresponding distro backport, with the stable commits at https://git.kernel.org/stable/c/882b8912b7e92341fdb115ba0e2e5142a28684ff, https://git.kernel.org/stable/c/96f44d493c280ea161569c43d7ed0f3b0815803a and https://git.kernel.org/stable/c/37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8 as the authoritative diffs (see also https://nvd.nist.gov/vuln/detail/CVE-2026-89906). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all LoongArch/Loongson Linux hosts and determine whether they run vulnerable 6.1.x, 6.6.x, 6.12.x, 6.15.x, 6.16.x, or 6.17.x kernels, confirm whether unprivileged BPF is disabled, restrict CAP_BPF/CAP_SYS_ADMIN to only essential administrators, and monitor these systems for soft lockups or unexpected BPF-related instability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Linux kernel builds with HID-BPF support (CONFIG_HID_BPF) can be crashed by a race that double-releases a HID device ref
Integer overflow in the cilium/ebpf Go library (versions up to 0.21.0) allows a local authenticated user to cause an ava
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today