Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) subsystem does not properly handle arena-related instructions when the JIT compiler is unavailable, causing the interpreter to execute unsupported opcodes and crash with a kernel BUG. A local user able to load BPF programs can trigger this crash, resulting in denial of service and potential system instability.
Technical details
The vulnerability exists in the BPF verifier and runtime selection logic in kernel/bpf/verifier.c and kernel/bpf/core.c. When a BPF program uses arena-related instructions (ST/LDX/STX), the interpreter does not support these opcodes but was not explicitly prevented from attempting to execute them via interpreter fallback. If JIT compilation is unavailable or disabled, the interpreter would encounter unknown opcode 0xa2 and hit a BUG_ON() assertion at kernel/bpf/core.c:2349, causing a kernel crash (Oops: invalid opcode). The fix sets the jit_required flag to true when arena maps are used, forcing JIT compilation and preventing interpreter fallback. This is a logic error rather than a memory corruption vulnerability, and the impact is local denial of service.
Affected products
- Linux Linux kernel 5.13 and later (versions containing BPF arena support)
Timeline
- 2026-07-15: disclosed: Fix committed by Leon Hwang
- 2026-07-19: patched: Merged upstream
- 2026-09-17: advisory: CVE-2026-93044 published