Executive brief
A vulnerability in the Linux kernel's LoongArch architecture support could allow a local user to crash the system. The issue occurs when the system attempts to process specific types of data structures within its internal tracing and monitoring components. This can lead to a complete system failure (kernel oops), impacting the availability of the server and any services running on it.
Technical details
A NULL pointer dereference or invalid memory access (kernel oops) exists in the LoongArch BPF JIT implementation. The root cause is a lack of support for 'struct' arguments in BPF trampoline programs within the __arch_prepare_bpf_trampoline function in arch/loongarch/net/bpf_jit.c. A local attacker with the ability to load or trigger specific BPF tracing programs can cause a kernel panic. The vulnerability was resolved by explicitly rejecting BPF trampoline programs that utilize struct arguments with an -ENOTSUPP error. Patches are available in the Linux stable tree.
Affected products
- Linux Linux 6.17, 6.17.3, 6.18
Timeline
- 2025-11-12: advisory: CVE published by NVD/kernel.org
- 2025-10-15: patched: Fix committed to Linux stable tree