Executive brief
The Linux kernel's RISC-V BPF JIT compiler has a memory leak that occurs when BPF program compilation fails during multi-pass compilation of subprograms. Memory allocated for JIT context offsets is not properly released, causing gradual memory waste on systems using RISC-V architecture with BPF capabilities. Over time, repeated failed compilations could consume available system memory.
Technical details
The vulnerability is a memory leak in the RISC-V BPF JIT compiler's bpf_jit_free() function. When bpf_int_jit_compile() is invoked for BPF subprograms, it returns early on the first pass while keeping jit_data->ctx.offset allocated for the subsequent extra pass. If JIT compilation fails for a later subprogram, the kernel aborts compilation and calls bpf_jit_free() to clean up—however, this function neglects to free jit_data->ctx.offset, causing a memory leak of the JIT context offsets array. The fix is a single-line addition of kfree(jit_data->ctx.offset) in the bpf_jit_free() function. The patch has been merged into the Linux kernel and is available as upstream commit 369e4635d04801f394d5bd42556f21029e95ff93.
Affected products
- Linux Linux Kernel Multiple versions (RISC-V BPF JIT affected)
Timeline
- 2026-07-08: disclosed: Issue reported and fix submitted
- 2026-07-21: patched: Patch merged into upstream kernel
- 2026-09-17: advisory: CVE-2026-92519 published