Executive brief
The Linux kernel's eBPF just-in-time (JIT) compiler on LoongArch systems contains a bug in tail call offset calculation that can cause incorrect branch jumps and system lockups. Systems running vulnerable kernel versions on LoongArch processors may experience service interruptions or hangs when executing certain eBPF programs, affecting workloads that depend on eBPF for networking, tracing, or security filtering.
Technical details
The vulnerability is a logic error in the LoongArch BPF JIT compiler's tail call handling (arch/loongarch/net/bpf_jit.c). The old implementation used a macro-based jmp_offset calculation that derived jump distances from stale prior-pass code stride information, leading to incorrect branch offsets across multiple JIT compilation passes. This causes soft lockups when the JIT compiler makes multiple passes over the same code. The fix refactors the offset calculation to directly compute "ctx->offset[insn + 1] - ctx->idx" as the jump target, and guards against false range-check aborts during size estimation by checking "ctx->image == NULL". The vulnerability is accessible only to root or processes with BPF capability; no network attack vector exists.
Affected products
- Linux Linux Kernel LoongArch architecture (affected versions unspecified; patch commits available)
Timeline
- 2026-09-16: disclosed
- 2026-08-17: patched: Upstream fix commit 37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8