{"id":"CVE-2026-93135","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject programs with inlined helpers if JIT is not available\n\nWhen an architecture (such as LoongArch, ARM64, and RISC-V) implements\nbpf_jit_inlines_helper_call(),…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject programs with inlined helpers if JIT is not available\n\nWhen an architecture (such as LoongArch, ARM64, and RISC-V) implements\nbpf_jit_inlines_helper_call(),…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 2ddec2c80b4402c293c7e6e0881cecaaf77e8cec < 21c6445366795fa3a89954e1d318e7c8afdef843","Linux >= 2ddec2c80b4402c293c7e6e0881cecaaf77e8cec < f1c27922576edccb99d0257827d09bd05c0304a6","Linux 6.10"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:18:08.373","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93135","references":[{"url":"https://git.kernel.org/stable/c/21c6445366795fa3a89954e1d318e7c8afdef843","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1c27922576edccb99d0257827d09bd05c0304a6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-17T16:21:47.746Z","epss":0.00189,"epssPercentile":0.08801,"slug":"CVE-2026-93135","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject programs with inlined helpers if JIT is not available\n\nWhen an architecture (such as LoongArch, ARM64, and RISC-V) implements\nbpf_jit_inlines_helper_call(), the verifier skips rewriting the helper\ncall offset (insn->imm) in bpf_do_misc_fixups(). This is because the\nhelper is expected to be inlined by the JIT compiler later. Therefore,\ninsn->imm remains as the raw helper enum ID.\n\nHowever, if JIT is disabled at runtime (net.core.bpf_jit_enable=0) or\nif JIT compilation fails dynamically (e.g., due to OOM), the program\nfalls back to the BPF interpreter.\n\nWhen the interpreter executes (__bpf_call_base + insn->imm) with the\nunpatched raw ID, it jumps into an invalid address space, triggering\nan instruction alignment fault or a kernel panic.\n\nAlthough these helpers have valid C implementations in the kernel, the\nomission of offset rewriting makes runtime interpreter fallback fatal.\n\nFix this by setting 'prog->jit_required = 1' when helper call rewriting\nis skipped for JIT inlining. This ensures that such programs are safely\nrejected if JIT is not available, preventing the runtime kernel panic.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}