Cloudanix VulnDB

CVE-2026-89581

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's just-in-time compiler for certain performance programs could let a local user crash the whole system when those programs are built with a particular compiler.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect REX prefix encoding in the x86 BPF JIT causes per-CPU address loads targeting extended registers (R8-R15) to resolve to aliased low registers instead, resulting in use of unadjusted non-per-CPU pointers and subsequent arbitrary memory dereferences.

Why it matters to the business

Local users or containers running untrusted BPF programs compiled with GCC can trigger kernel crashes or memory corruption, leading to denial of service on systems that rely on extended-register BPF code paths.

How an attack unfolds

An attacker compiles a BPF program with GCC that keeps multiple per-CPU addresses live in extended registers, loads the program via bpf(), and triggers execution (e.g., via raw tracepoints or maps); the JIT emits a MOV that clobbers the wrong register, causing the program to dereference an invalid address and panic the kernel.

How to fix it

Upgrade to a Linux kernel containing the fix that replaces add_1mod() with add_2mod() for the per-CPU address MOV instruction; rebuild and redeploy any BPF programs compiled with GCC after the update.

How to confirm the fix worked

Confirm the presence of the corrected JIT emission logic in the running kernel; re-run BPF selftests compiled with BPF_GCC and verify that global_percpu_data and similar tests no longer panic.

Typical attack path

  1. Compile BPF program using GCC so that per-CPU addresses reside in BPF_REG_5 or higher extended registers
  2. Load and attach the program via the bpf() syscall
  3. Trigger program execution through a suitable hook (raw_tp, kprobe, etc.)
  4. Observe kernel page fault or panic due to dereference of non-per-CPU address

How to detect it

Search kernel logs for 'BUG: unable to handle page fault' or 'Fatal exception in interrupt' entries containing bpf_prog_*_update_percpu_data or __bpf_prog_test_run_raw_tp; inspect JITed BPF images for incorrect REX prefix usage on per-CPU MOV instructions.

  • BUG: unable to handle page fault for address:.*bpf_prog_.*update_percpu_data
  • RIP:.*bpf_prog_.*update_percpu_data
  • 65 49 03 04 25.*add %gs:

What your security team should do

  • Prioritize kernel updates on systems that permit unprivileged BPF loading or run GCC-compiled BPF programs
  • Restrict unprivileged BPF via sysctl kernel.unprivileged_bpf_disabled=1 until patched
  • Monitor for kernel oops involving bpf_prog_*_update_percpu_data after loading new programs

The record

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add_1mod(), which sets REX.B. REX.B extends ModRM.rm and SIB.base, and this instruction addresses memory as disp32 with no base, so the bit has no effect at all and the high register bit is simply lost. Every is_ereg() destination therefore resolves to the wrong register, picking whichever one shares the low three bits: R5 -> RAX R7 -> RBP R8 -> RSI R9 -> RDI With BPF_REG_5, whose reg2hex is 0, the emitted 65 49 03 04 25 <off> add %gs:<off>,%rax adds the per-CPU offset to RAX rather than R8. The destination keeps the unadjusted address and RAX is clobbered, so the program goes on to dereference a pointer that was never made per-CPU: BUG: unable to handle page fault for address: 0000607e386a8894 RIP: bpf_prog_707837aafd2aa9ae_update_percpu_data+0x93/0xc9 Call Trace: __bpf_prog_test_run_raw_tp+0x2dc/0x7d0 __flush_smp_call_function_queue+0x1e9/0xc80 Kernel panic - not syncing: Fatal exception in interrupt R5 is the mildest of the four, aliasing a scratch register and faulting at the store. R7 aliases RBP and would corrupt the frame pointer, R8 and R9 alias the argument registers. Use add_2mod() so the register goes through REX.R, matching how add_2reg() places it in ModRM.reg and how emit_priv_frame_ptr() hardcodes 0x4c for the same instruction with R9. Encodings for the non-extended registers are unchanged. Problem showed up when trying to resurrect BPF_GCC CI (selftests built with BPF_GCC). This has gone unnoticed because clang reloads the address into R1 before each per-CPU access, so the destination is never an extended register. GCC keeps several per-CPU addresses live at once, and test_progs-bpf_gcc panics the kernel in global_percpu_data/init, where the address of a .percpu variable ends up in R5.

Affected packages

Ecosystem Package Introduced Fixed