Executive brief
A flaw in the Linux kernel's BPF (Berkeley Packet Filter) JIT compiler on x86 architectures causes incorrect CPU register encoding when handling per-CPU memory addresses. When certain BPF programs access per-CPU data structures, the compiler emits wrong machine code that corrupts processor registers and writes to invalid memory locations, leading to kernel panics and denial of service. This affects systems running BPF programs compiled with GCC.
Technical details
The vulnerability is a machine code generation bug in the BPF x86 JIT compiler's per-CPU address resolution. The REX prefix is incorrectly constructed using add_1mod() which sets REX.B instead of add_2mod() which sets REX.R, causing extended registers (R5, R7, R8, R9) to resolve to wrong base registers (RAX, RBP, RSI, RDI respectively). When BPF_REG_5 is used as the destination, the ADD instruction writes to RAX instead of R8, leaving the original address unmodified and clobbering a scratch register. The issue only manifests with BPF programs compiled by GCC; clang-compiled programs reload addresses before each access, avoiding extended register destinations. Exploitation results in page faults, kernel panics, and denial of service. The fix involves using add_2mod() instead of add_1mod() to properly encode the REX prefix.
Affected products
- Linux Linux kernel unknown
Timeline
- 2026-09-11: disclosed