CVE-2026-92518

What it actually does

The flaw miscalculates the jump offset in BPF tailcalls on RISC-V when CONFIG_CFI_CLANG is enabled, causing the program to skip the kCFI instruction a second time and bypass the required stack pointer adjustment, resulting in kernel stack corruption.

Why it matters to the business

Systems running affected Linux kernels on RISC-V hardware may experience crashes, instability, or unauthorized code execution in kernel mode, disrupting services and requiring emergency patching across fleets.

How an attack unfolds

An attacker with local access loads a crafted BPF program that performs a tailcall; under the CFI configuration the incorrect offset skips stack adjustment, corrupting kernel memory and enabling privilege escalation or denial of service.

How to fix it

Apply the upstream kernel patch that corrects the tailcall jump offset calculation for CFI on RISC-V and rebuild or upgrade to a fixed kernel release.

How to confirm the fix worked

Confirm the kernel configuration enables CFI, verify the source contains the corrected offset arithmetic for prog->bpf_func in tailcalls, and execute test BPF programs on RISC-V hardware to ensure no stack corruption occurs.

Typical attack path

1. Obtain local user access on a vulnerable RISC-V Linux system
2. Load a malicious BPF program containing a tailcall
3. Trigger execution of the tailcall path
4. Exploit resulting stack corruption for kernel-level impact

How to detect it

Search kernel logs and audit trails for oops or panic messages referencing BPF tailcalls or stack pointer adjustments on RISC-V; inspect system call traces involving bpf_prog and tail_call operations.

What your security team should do

• Prioritize kernel upgrades on all RISC-V systems within the next maintenance window
• Audit BPF program usage and restrict unprivileged BPF loading where feasible
• Include RISC-V CFI configurations in regression testing for future kernel updates