Executive brief
The Linux kernel's ARM breakpoint handler had a logic flaw where CFI (Control Flow Integrity) breakpoint type 0x03 was reserved even when CFI instrumentation was not in use, preventing legitimate userspace breakpoint use. This fix makes CFI breakpoint handling conditional, only active when CFI is actually enabled, allowing userspace to use breakpoints when appropriate.
Technical details
This is a logic error in the ARM hw_breakpoint.c handler where the hw_breakpoint_cfi_handler() stub was unconditionally catching breakpoint type 0x03 (ARM_ENTRY_CFI_BREAKPOINT) even when CONFIG_CFI was disabled. The fix adds a CONFIG_CFI preprocessor guard and user-mode check to hw_breakpoint_pending(), ensuring CFI breakpoint handling only occurs when CFI is enabled in the kernel and the breakpoint originates from kernel space. When these conditions are not met, the handler now properly returns 1 (unhandled) to allow userspace to manage the breakpoint. No security vulnerability is present; this is a functional regression fix for breakpoint availability.
Affected products
- Linux Linux kernel Multiple versions across 2.6.x through 7.2.x
Timeline
- 2026-09-17: disclosed
- 2026-07-04: patched