CVE-2026-93043

What it actually does

The vulnerability allows a BPF program using the insn_array map (which emits BPF_JMP|BPF_JA|BPF_X gotox instructions) to fall back to the interpreter; the interpreter lacks support for this opcode and triggers a BUG_ON in ___bpf_prog_run, producing an invalid-opcode oops.

Why it matters to the business

Systems that load certain eBPF programs can experience sudden kernel crashes and reboots, causing service outages and loss of availability until the kernel is updated.

How an attack unfolds

An attacker with the ability to load unprivileged or privileged BPF programs constructs a program that uses the insn_array map feature; when the kernel attempts to run it without JIT, the interpreter hits the unsupported opcode path and crashes the system.

How to fix it

Upgrade to a kernel containing the referenced commit that forces jit_required=true when insn_array maps are used; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking for the presence of the jit_required assignment in kernel/bpf/core.c::__bpf_prog_select_runtime and verify that BPF programs using insn_array maps now require JIT.

Typical attack path

1. Obtain capability to load a BPF program (CAP_BPF or unprivileged_bpf_disabled=0)
2. Create a program that references an insn_array map, emitting gotox instructions
3. Load the program so that __bpf_prog_select_runtime selects interpreter fallback
4. Trigger execution of the program to reach the BUG_ON in ___bpf_prog_run

How to detect it

Search kernel logs (dmesg, journalctl) for the strings 'BPF interpreter: unknown opcode' and 'kernel BUG at kernel/bpf/core.c:2349'; correlate with recent BPF program loads via audit or bpftrace.

• BPF interpreter: unknown opcode 0d
• kernel BUG at kernel/bpf/core.c:2349
• Oops: invalid opcode: 0000

What your security team should do

• Apply the kernel update that sets jit_required for insn_array maps as soon as a distribution package is available
• Audit environments that permit unprivileged BPF loading and consider tightening access
• Monitor for kernel oops messages containing 'BPF interpreter: unknown opcode'