Executive brief
The Linux kernel's RISC-V just-in-time (JIT) compiler for Berkeley Packet Filter (BPF) programs fails to properly sign-extend signed 1-byte and 2-byte function arguments when calling kernel functions (kfunc). This ABI compliance issue can cause BPF programs to receive incorrect signed integer values, leading to incorrect program behavior or potential privilege escalation on RISC-V systems running affected kernels.
Technical details
The vulnerability is an incomplete implementation of ABI compliance in the RISC-V 64-bit BPF JIT compiler (bpf_jit_comp64.c). The RV64 ABI requires sign-extension for signed 1-byte and 2-byte kfunc arguments, but the JIT only applied sign-extension to 4-byte (sizeof(int)) arguments via emit_sextw(). After commit 7ce090afbf72, state pruning changes exposed this bug, causing the kfunc_call_test4 selftest to fail. The fix extends the sign-extension logic to handle all signed argument sizes by introducing a sign_extend() function that respects the BTF_FMODEL_SIGNED_ARG flag. The vulnerability requires a BPF program to call a kfunc with signed 1- or 2-byte arguments; the attacker must be able to load and execute a malicious BPF program. The patch is available and included in stable kernel branches.
Affected products
- Linux Linux kernel Multiple versions with RISC-V BPF JIT support affected; patched in stable branches
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-09-14: patched: Fix committed to stable kernel branches
- 2026-08-14: other: Upstream patch authored by Pu Lehui