Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) virtual machine interpreter does not recognize a specific instruction type (gotox) that is used for indirect jumps in extended BPF maps. When this unrecognized instruction is encountered at runtime, it triggers a kernel panic (BUG_ON condition), causing an immediate system crash and service outage.
Technical details
The vulnerability is a missing opcode handler in the BPF interpreter (kernel/bpf/core.c) for the BPF_JMP|BPF_JA|BPF_X instruction class, which is used by insn_array maps for indirect jumps. When a BPF program using insn_array maps attempts to execute via the interpreter rather than JIT compilation, the unknown opcode triggers a BUG_ON() panic at kernel/bpf/core.c:2349. The fix sets jit_required=true when insn_array maps are detected during program verification (kernel/bpf/verifier.c), forcing JIT compilation and bypassing the vulnerable interpreter path. This is a denial-of-service condition affecting systems where BPF programs with insn_array maps may fall back to interpretation rather than JIT compilation.
Affected products
- Linux Linux kernel Multiple versions including linux-5.x, linux-6.x, and earlier
Timeline
- 2026-07-15: disclosed: Original commit date by Leon Hwang
- 2026-07-19: patched: Upstream commit 905f716362e1186c1a23447ca279e6d21f795cdb merged
- 2026-09-17: advisory: CVE-2026-93043 published
- 2026-09-14: patched: Fix backported to stable kernel series