Executive brief
The Linux kernel's LoongArch architecture implementation of Berkeley Packet Filter (BPF) had a stack layout bug that could cause memory corruption when BPF arena features are dynamically enabled. The vulnerable code incorrectly positioned stack slots used for tracking BPF operations, leading to memory addresses being calculated incorrectly and potentially corrupting adjacent data structures. This fix reorders the stack layout to prevent such misalignment.
Technical details
This vulnerability is a stack layout bug in the LoongArch BPF JIT compiler (arch/loongarch/net/bpf_jit.c). The root cause is that the arena register save slot was positioned above the tail call counter (tcc_ptr) slot in the stack frame. When arena_vm_start is dynamically enabled at runtime, it shifts the relative offset of the tcc_ptr slot, breaking hardcoded offset macros and causing stack frame misalignment or memory corruption. The fix relocates the arena register slot below the tcc_ptr context by reordering the save and restore sequences in build_prologue() and __build_epilogue(), ensuring tcc_ptr maintains a fixed distance from the base callee-saved registers regardless of arena feature state. No authentication or network access is required; exploitation would occur through crafted BPF programs executing on systems with LoongArch CPU and kernel BPF support. Patches have been merged upstream and in stable kernels.
Affected products
- Linux Linux Kernel LoongArch architecture BPF JIT implementations prior to patch cd7e356b07a27e91394838cf3fb655862b519294
Timeline
- 2026-09-16: disclosed: CVE-2026-89905 published
- 2026-08-17: patched: Patch cd7e356b07a27e91394838cf3fb655862b519294 committed upstream
- 2026-09-11: patched: Backported to stable kernel f0e4d069cb47cf4f8dc4f6bc104e0671155aa3b9