Linux Kernel Vulnerability Related to BPF Execution Memory Management

CVE-2026-99092

What is CVE-2026-99092?

This vulnerability in the Linux kernel arises from improper handling of execution memory addresses in the BPF (Berkeley Packet Filter) subsystem, specifically when working with the JIT compilation of BPF programs. The issue stems from assumptions made about the writeability of the kernel text and the vmalloc area based on certain configuration options. Notably, in some configurations, BPF text memory is treated as read-only, which can lead to failures when attempts are made to perform JIT compilation on those binaries. As a result, BPF programs may fail to execute correctly, propagating errors and warnings that indicate failed compilation. This vulnerability emphasizes the need for proper checks and handling mechanisms in the execution memory mappings, particularly with varying kernel configurations.

References