Cloudanix VulnDB

CVE-2026-92516

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A mistake in the Linux kernel's eBPF safety checks could let specially written programs slip past validation, potentially affecting stability of tools that rely on eBPF.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The BPF verifier performed an incorrect offset validation for BPF_RES_SPIN_LOCK by erroneously checking the BPF_SPIN_LOCK offset field instead of the dedicated res_spin_lock_off field, allowing malformed spin-lock usage in BPF programs to bypass intended checks.

Why it matters to the business

Organizations running affected kernels face potential instability or bypass of safety checks in eBPF-based security, networking, or observability tools, increasing risk of kernel panics or unexpected behavior in production workloads; low exploitability keeps immediate urgency moderate but patching is still required.

How an attack unfolds

An attacker crafts a malicious BPF program that uses BPF_RES_SPIN_LOCK with an invalid offset; the flawed case statement fails to trigger the proper warning or rejection, potentially allowing the program to load and execute with incorrect memory assumptions that could lead to verifier bypass or runtime issues.

How to fix it

Update to a kernel version containing the fix for the res_spin_lock_off check in the BPF verifier; rebuild and redeploy any custom BPF programs after the update.

How to confirm the fix worked

Confirm the kernel source contains the corrected case statement checking res_spin_lock_off for BPF_RES_SPIN_LOCK; attempt to load test BPF programs that previously triggered the incorrect path and verify proper rejection or warning behavior.

Typical attack path

  1. Identify a system exposing unprivileged or privileged BPF program loading
  2. Craft a BPF program containing a BPF_RES_SPIN_LOCK instruction with a deliberately incorrect offset
  3. Load the program via bpf() syscall, bypassing the misdirected offset check
  4. Trigger execution of the loaded program to induce verifier or runtime anomalies

How to detect it

Search kernel logs for BPF verifier warnings related to spin locks or offset checks; examine audit logs of bpf() syscalls for unusual program loads after the publication date; no widespread exploitation artifacts are known.

What your security team should do

  • Prioritize kernel upgrades on systems that load untrusted or complex BPF programs
  • Review eBPF usage in security tooling and observability stacks for exposure
  • Monitor upstream kernel changelogs for related verifier hardening commits
  • Apply the fix within standard patch cycles given low EPSS and absence from KEV

The record

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix offset warn check for bpf_res_spin_lock Sashiko pointed out correctly that the case statement for BPF_RES_SPIN_LOCK incorrectly checks offset for BPF_SPIN_LOCK. Fix it by checking res_spin_lock_off instead.

Affected packages

Ecosystem Package Introduced Fixed