Executive brief
The Linux kernel's RISC-V BPF JIT compiler has a memory corruption bug when Control Flow Integrity (CFI) is enabled. A specially crafted BPF program using tailcalls can cause the kernel to skip critical stack pointer adjustments, corrupting kernel memory and potentially causing a denial of service or privilege escalation.
Technical details
The vulnerability exists in the RISC-V BPF JIT compiler (arch/riscv/net/bpf_jit_comp64.c) when CONFIG_CFI_CLANG is enabled. The tailcall jump offset calculation incorrectly double-counts the KCFI instruction skip, causing the JIT-compiled code to jump 4 extra bytes past the intended target. This causes the stack pointer adjustment code to be skipped entirely, resulting in kernel stack corruption. The root cause is that prog->bpf_func already skips the KCFI preamble during setup, but the tailcall epilogue was adding the KCFI offset again. The fix removes the RV_KCFI_NINSNS constant from the tailcall jump offset calculation. No special privileges or network access is required to exploit this; any user who can load a malicious BPF program can trigger it. The vulnerability was patched in the Linux kernel stable tree.
Affected products
- Linux Linux kernel Multiple versions (see stable tree references); affects systems with CONFIG_CFI_CLANG and RISC-V BPF JIT enabled
Timeline
- 2026-09-17: disclosed
- 2026-07-21: patched: Upstream commit 52fb1756ea1d2759dfef2d86245be00b05dac3a2