CVE-2021-29154

What it actually does

Incorrect computation of branch displacements in the x86 BPF JIT compiler allows a local attacker to execute arbitrary code within the kernel context by loading a crafted BPF program.

Why it matters to the business

Unpatched Linux systems remain exposed to full kernel compromise, enabling attackers to bypass all user-space protections, access sensitive data, install persistent malware, or disrupt operations across servers, containers, and embedded devices.

How an attack unfolds

An attacker with local access crafts a BPF program whose branch offsets are miscalculated by the JIT due to the displacement bug; when the kernel JITs and executes the program, control flow is redirected to attacker-controlled instructions running with kernel privileges.

How to fix it

Upgrade the Linux kernel to a version containing commit 26f55a59dc65ff77cd1c4b37991e26497fc68049 or later; rebuild and reboot all affected systems; disable unprivileged BPF loading via sysctl where JIT is not required.

How to confirm the fix worked

Verify the running kernel was built from a tree containing commit 26f55a59dc65ff77cd1c4b37991e26497fc68049; confirm sysctl net.core.bpf_jit_enable reflects the updated compiler behavior; test with known BPF programs that previously triggered the displacement error.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Load a malicious BPF program via bpf() syscall or eBPF tools
3. Trigger JIT compilation of the program
4. Exploit the miscomputed branch displacement to hijack kernel execution
5. Escalate to full kernel code execution and system takeover

How to detect it

Review kernel audit logs and BPF event traces for unexpected program loads followed by anomalous kernel behavior; examine dmesg and /var/log/kern.log for JIT-related warnings or crashes around the time of suspicious activity.

What your security team should do

• Prioritize patching all production kernels to the fixed commit
• Restrict unprivileged BPF access on systems that cannot be immediately updated
• Monitor for new kernel releases and automate patch deployment pipelines
• Audit container hosts and embedded devices for outdated kernels