Executive brief
The Linux kernel's LoongArch architecture implements dynamic code instrumentation (kprobes) using a breakpoint mechanism. A flaw in the handler allows userspace code to trigger an imbalance in the kernel's preemption counter, causing the system to incorrectly believe it is in interrupt context. This can lead to network traffic being misattributed to the root cgroup, allowing users to bypass container networking policies.
Technical details
The vulnerability is a logic error in the kprobe_singlestep_handler() function on LoongArch systems. When a userspace process issues a break 11 instruction (which is reserved for kprobe single-stepping), the handler invokes preempt_enable_no_resched() before checking whether an active probe actually exists. The corresponding preempt_disable() call in kprobe_breakpoint_handler() is never executed in this case, causing preemption counter underflow. This causes in_interrupt() to return true until the next context switch, allowing allocation operations to be attributed to the root cgroup rather than the calling task's cgroup. A local unprivileged user can exploit this to bypass BPF_CGROUP_INET_SOCK_CREATE socket creation policies. The fix adds an early return check for !cur (no active probe) before calling preempt_enable_no_resched().
Affected products
- Linux Linux kernel LoongArch architecture (since kprobes support was added in commit 6d4cc40fb5f5)
Timeline
- 2026-09-16: disclosed: CVE published
- 2026-09-04: patched: Fix committed as 72ce4b24676e8b3b75376c4c559dd81c1ac52d5a
- 2026-09-11: patched: Fix backported to stable trees (commit 76395109a051b53860faaec96522ef08ae9e8e27)