CVE-2026-93270
Gravedad:
Pendiente de análisis
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
24/09/2026
Última modificación:
19/10/2026
Descripción
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn<br />
<br />
The BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for<br />
&#39;dst_reg = src_reg + &#39;.<br />
<br />
However, the interpreter ignores the &#39;off&#39; at its ALU64_MOV_X label.<br />
The &#39;off&#39; indicates the insn is BPF_MOV64_PERCPU_REG insn. Then, when<br />
the interpreter loads memory from the register, it will hit a page<br />
fault.<br />
<br />
[ 2.545572] BUG: unable to handle page fault for address: ffffffffacaaf034<br />
[ 2.546485] #PF: supervisor read access in kernel mode<br />
[ 2.547167] #PF: error_code(0x0000) - not-present page<br />
[ 2.547850] PGD 134e63067 P4D 134e63067 PUD 134e64063 PMD 10021c063 PTE 800ffffeca550062<br />
[ 2.548912] Oops: Oops: 0000 [#1] SMP PTI<br />
<br />
Set jit_required as true in order to disallow interpreter fallback in<br />
core.c::__bpf_prog_select_runtime(), if any BPF_ADDR_PERCPU insn is<br />
patched to the prog.<br />
<br />
BTW, rename the helper bpf_map_supports_cpu_flags() to<br />
bpf_map_is_percpu_map().


