CVE-2026-92486

What it actually does

A control-flow integrity (CFI) mismatch occurs when BPF subprograms are invoked via task work using an incompatible three-argument function pointer instead of the expected bpf_callback_t ABI, potentially leading to kernel integrity checks failing.

Why it matters to the business

Systems running affected Linux kernels may experience crashes or unexpected behavior when using certain BPF programs, impacting stability of servers and applications relying on eBPF.

How an attack unfolds

An attacker crafts or loads a BPF program that registers a subprogram as a task work callback, triggering the ABI mismatch during invocation and causing a CFI violation.

How to fix it

Update the Linux kernel to a version that includes the fix for storing and invoking the callback as bpf_callback_t.

How to confirm the fix worked

Verify kernel version and check for the patch in BPF task work handling code.

Typical attack path

1. Identify or create BPF program with task work callback
2. Load the program into kernel
3. Trigger the callback execution
4. Observe or exploit the resulting CFI trip

How to detect it

Look for kernel logs indicating CFI violations related to BPF or task work callbacks.

What your security team should do

• Prioritize kernel updates on production systems
• Monitor for CFI violation logs
• Test BPF programs in staging environments