Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) subsystem can crash when certain architectures use JIT compilation optimizations for helper functions but the JIT compiler becomes unavailable at runtime. If JIT is disabled or fails, the system falls back to an interpreter that attempts to call unpatched helper functions, causing a kernel panic. This affects systems running eBPF programs on LoongArch, ARM64, and RISC-V architectures.
Technical details
The vulnerability occurs in the BPF verifier's bpf_do_misc_fixups() function when handling architectures that implement bpf_jit_inlines_helper_call(). For these architectures, the verifier skips rewriting helper call offsets (insn->imm), expecting the JIT compiler to inline them later. However, when JIT is disabled at runtime (net.core.bpf_jit_enable=0) or fails dynamically (e.g., OOM), the program falls back to the interpreter. The interpreter then attempts to execute with the unpatched raw helper enum ID, jumping into invalid address space and triggering an instruction alignment fault or kernel panic. The fix sets prog->jit_required=1 when helper rewriting is skipped, ensuring such programs are rejected if JIT is unavailable rather than causing a panic.
Affected products
- Linux Linux kernel LoongArch, ARM64, RISC-V architectures with BPF JIT; affects multiple kernel versions
Timeline
- 2026-07-08: disclosed: Patch authored
- 2026-09-14: patched: Stable tree commit included
- 2026-09-17: advisory