CVE-2026-92485

What it actually does

Incorrect bitwise update of tr->flags in the BPF verifier allows trampoline corruption when multiple fexit links attach to tail_call_reachable programs; the trampoline writes a jmp instruction instead of a call, and later release paths fail to restore the original nop, triggering a kernel WARNING and potential memory corruption.

Why it matters to the business

Systems running eBPF tracing or security tools may experience kernel warnings, instability, or crashes, increasing operational risk and unplanned downtime especially in environments with heavy BPF usage.

How an attack unfolds

An attacker with local access loads a tail_call_reachable eBPF program, attaches an fexit link to set combined flags, then attaches a second fexit link that clears the CALL_ORIG flag; closing the first link leaves the trampoline in a corrupted state that writes incorrect instructions into the target program.

How to fix it

Apply the upstream kernel patch that changes the flag assignment to use |= when setting BPF_TRAMP_F_TAIL_CALL_CTX; rebuild and deploy updated kernel packages to all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting kernel source or running a reproducer that previously triggered the WARNING; verify absence of the stack trace in dmesg after repeated attach/close cycles of fexit links on tail_call_reachable programs.

Typical attack path

1. Obtain local unprivileged or low-privileged access on a Linux host
2. Load a tail_call_reachable eBPF program via bpf() syscall
3. Attach first fexit link to set BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX
4. Attach second fexit link to overwrite flags with only BPF_TRAMP_F_TAIL_CALL_CTX
5. Close first link to trigger bpf_tracing_link_release with incorrect restore logic
6. Observe kernel WARNING and potential trampoline memory corruption

How to detect it

Search kernel logs and dmesg for the string 'WARNING: kernel/bpf/syscall.c' combined with 'bpf_tracing_link_release'; inspect audit logs for sequences of bpf() syscalls that load programs with tail_call_reachable attributes followed by multiple link attach and close operations.

• WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release
• bpf_link_free+0x58/0x130
• bpf_link_release+0x23/0x30

What your security team should do

• Prioritize kernel updates on any system exposing eBPF to untrusted local users
• Monitor for the specific WARNING in bpf_tracing_link_release via centralized logging
• Restrict unprivileged BPF program loading via sysctl kernel.unprivileged_bpf_disabled until patched