CVE-2026-93044

What it actually does

BPF programs using arena maps can fall back to the interpreter which lacks support for arena ST/LDX/STX instructions, triggering a BUG_ON() in ___bpf_prog_run() and causing an invalid opcode kernel panic.

Why it matters to the business

Unprivileged local users or compromised workloads can crash Linux systems running affected kernels, leading to denial of service and potential loss of availability for services relying on eBPF.

How an attack unfolds

An attacker loads a BPF program referencing an arena map; because jit_required is not forced, the runtime selects the interpreter which encounters an unknown opcode and panics the kernel.

How to fix it

Apply the upstream kernel patch that sets jit_required=true whenever an arena map is referenced by a program; rebuild and reboot to the fixed kernel version.

How to confirm the fix worked

Confirm the patch is present by inspecting core.c::__bpf_prog_select_runtime() for arena-map jit_required logic; attempt to load an arena-using program and verify JIT is enforced without fallback.

Typical attack path

1. Identify or create a BPF program that uses arena map instructions
2. Load the program via bpf() syscall without JIT enforcement
3. Trigger interpreter execution path in __bpf_prog_select_runtime()
4. Interpreter hits BUG_ON() in ___bpf_prog_run() resulting in kernel oops

How to detect it

Search kernel logs and dmesg for 'BPF interpreter: unknown opcode a2' and 'kernel BUG at kernel/bpf/core.c:2349' entries indicating attempted interpreter execution of arena instructions.

• BPF interpreter: unknown opcode a2 (imm: 0x0)
• kernel BUG at kernel/bpf/core.c:2349
• Oops: invalid opcode: 0000 [#1] SMP PTI

What your security team should do

• Patch and reboot all Linux systems within the next maintenance window given the 37-day publication window
• Restrict unprivileged BPF program loading via sysctl kernel.unprivileged_bpf_disabled=1 until patched
• Monitor kernel logs for BPF interpreter unknown opcode messages