Executive brief
The Linux kernel's s390 architecture BPF just-in-time compiler fails to properly zero the upper 32 bits of a 64-bit register when loading a 32-bit CPU number. This can lead to information disclosure or denial of service on s390 systems running BPF programs that query processor identity.
Technical details
The vulnerability exists in the s390 BPF JIT compiler in arch/s390/net/bpf_jit_comp.c when handling the BPF_FUNC_get_smp_processor_id function. The code uses the 'ly' (load 32-bit) instruction to load a 32-bit cpu_nr value into BPF_REG_0 (a 64-bit register), but 'ly' does not zero the upper 32 bits, leaving them with uninitialized kernel memory contents. The fix replaces 'ly' with 'llgf' (load logical 32-bit), which properly zero-extends the value into the full 64-bit register. This is a register sign/zero-extension bug affecting BPF programs on s390 systems. The patch has been merged upstream and backported to stable kernel series.
Affected products
- Linux Linux kernel Various s390 kernel versions prior to fix commit 5f6cc299938b561cb01e343bab7042611fcee12a
Timeline
- 2026-07-03: other: Fix commit authored
- 2026-07-07: patched: Fix merged to mainline
- 2026-09-17: disclosed: CVE-2026-93147 published