Executive brief
A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) component for ARM64 systems. This component is responsible for running high-performance programs within the operating system kernel. An error in how the system calculates memory addresses for certain instructions could cause the system to execute code in an unintended order, potentially leading to system instability or crashes.
Technical details
An off-by-one error exists in the check_imm() macro within the ARM64 BPF JIT compiler (arch/arm64/net/bpf_jit_comp.c). The macro was incorrectly validating signed N-bit immediate fields using a check that admitted a signed (N+1)-bit range. Specifically, for 19-bit and 26-bit branch displacements, values that exceeded the intended signed range but passed the faulty check would have their sign bit incorrectly masked by aarch64_insn_encode_immediate(). This results in forward branches being flipped into backward branches during instruction encoding. An attacker capable of loading BPF programs could potentially trigger unexpected kernel execution flow. The issue has been patched by adjusting the bit shift in the range check from 'bits' to 'bits - 1'.
Affected products
- Linux Linux 3.18 to 6.1.175, 6.6.x, 6.12.x
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://git.kernel.org/stable/c/1a113b5497297871699cd498b1b83542e0db7f15
- https://git.kernel.org/stable/c/1dd8be4ec722ce54e4cace59f3a4ba658111b3ec
- https://git.kernel.org/stable/c/6927f0d6794aa73318bbfa929f1ff6065b0620df
- https://git.kernel.org/stable/c/7fd3b41260c6120e7b60164afea5d961af6224f9
- https://git.kernel.org/stable/c/a5dfeb3b61065039488342d43ae06d4729d955d4
- https://git.kernel.org/stable/c/fb74defa1cca1a73177c0c761e641332e4f979a3