CVE-2026-92519

What it actually does

Memory leak of the JIT context offsets array (ctx->offset) in bpf_jit_free() on RISC-V when BPF subprogram compilation fails after the first pass, leaving the array allocated.

Why it matters to the business

Gradual kernel memory exhaustion on RISC-V systems that use BPF networking or tracing, potentially causing performance degradation, instability, or denial of service under sustained load.

How an attack unfolds

An attacker repeatedly loads specially crafted BPF programs containing multiple subprograms that succeed on the initial pass but fail JIT compilation on a later subprogram, triggering the incomplete cleanup path in bpf_jit_free and leaking memory each time until the system is exhausted.

How to fix it

Apply the upstream kernel fix that adds kfree(jit_data->ctx.offset) inside bpf_jit_free() for the RISC-V JIT; rebuild and deploy the patched kernel on all RISC-V systems.

How to confirm the fix worked

Inspect the bpf_jit_free() function in the RISC-V BPF JIT source to confirm the kfree call for ctx->offset is present; test by triggering subprogram JIT failure paths and verifying no leak via slab or kmemleak tools.

Typical attack path

1. Load BPF program with multiple subprograms that passes the first JIT pass
2. Force JIT failure on a subsequent subprogram
3. Repeat loading to accumulate leaked ctx->offset allocations
4. Monitor for kernel memory pressure or OOM conditions

How to detect it

Review kernel logs for BPF JIT compilation failure messages during subprogram processing; use memory accounting tools to track allocations related to JIT data structures after repeated BPF loads.

What your security team should do

• Patch Linux kernels on RISC-V hardware as soon as fixed builds are available
• Limit unprivileged BPF loading via sysctl or capabilities until patched
• Monitor kernel memory usage and BPF JIT statistics for anomalous growth