{"id":"CVE-2026-89906","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: BPF: Refactor jump offset calculation in tail call\n\nThe old macro-based jmp_offset calculation derives the jump distance\nfrom a stale prior-pass code stride,…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: BPF: Refactor jump offset calculation in tail call\n\nThe old macro-based jmp_offset calculation derives the jump distance\nfrom a stale prior-pass code stride,…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 < 882b8912b7e92341fdb115ba0e2e5142a28684ff","Linux >= cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 < 96f44d493c280ea161569c43d7ed0f3b0815803a","Linux >= cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 < 37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8","Linux 1a782fa32e644aa9fbae6c8488f3e61221ac96e1","Linux 17c010fe45def335fe03a0718935416b04c7f349","Linux f83d469e16bb1f75991ca67c56786fb2aaa42bea","Linux f2b5e50cc04d7a049b385bc1c93b9cbf5f10c94f","Linux 9262e3e04621558e875eb5afb5e726b648cd5949","Linux >= 6.1.149 < 6.2","Linux >= 6.6.103 < 6.7","Linux >= 6.12.43 < 6.13","Linux >= 6.15.11 < 6.16","Linux >= 6.16.2 < 6.17","Linux 6.17"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T15:18:16.683","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89906","references":[{"url":"https://git.kernel.org/stable/c/37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/882b8912b7e92341fdb115ba0e2e5142a28684ff","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96f44d493c280ea161569c43d7ed0f3b0815803a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-16T10:53:53.976Z","epss":0.00161,"epssPercentile":0.05757,"slug":"CVE-2026-89906","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: BPF: Refactor jump offset calculation in tail call\n\nThe old macro-based jmp_offset calculation derives the jump distance\nfrom a stale prior-pass code stride, which can lead to wrong branch\noffsets and soft lockups under extra JIT passes.\n\nFix this by calculating the offset directly on the absolute target:\n\"ctx->offset[insn + 1] - ctx->idx\".\n\nTo avoid a false 16-bit range check abort during size estimation, add\na \"ctx->image == NULL\" guard to inject a safe dummy offset.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":205146,"id":"CVE-2026-89906","ts":1789570705458,"field":"cvss","old":null,"new":"7.8"},{"seq":205145,"id":"CVE-2026-89906","ts":1789570705458,"field":"severity","old":"none","new":"high"}]}