---
id: CVE-2026-89906
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  LoongArch: BPF: Refactor jump offset calculation in tail call

  The old macro-based jmp_offset calculation derives the jump distance
  from a stale prior-pass code stride,…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  LoongArch: BPF: Refactor jump offset calculation in tail call

  The old macro-based jmp_offset calculation derives the jump distance
  from a stale prior-pass code stride,…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 <
    882b8912b7e92341fdb115ba0e2e5142a28684ff
  - >-
    Linux >= cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 <
    96f44d493c280ea161569c43d7ed0f3b0815803a
  - >-
    Linux >= cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 <
    37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8
  - Linux 1a782fa32e644aa9fbae6c8488f3e61221ac96e1
  - Linux 17c010fe45def335fe03a0718935416b04c7f349
  - Linux f83d469e16bb1f75991ca67c56786fb2aaa42bea
  - Linux f2b5e50cc04d7a049b385bc1c93b9cbf5f10c94f
  - Linux 9262e3e04621558e875eb5afb5e726b648cd5949
  - Linux >= 6.1.149 < 6.2
  - Linux >= 6.6.103 < 6.7
  - Linux >= 6.12.43 < 6.13
  - Linux >= 6.15.11 < 6.16
  - Linux >= 6.16.2 < 6.17
  - Linux 6.17
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:16.683'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89906'
references:
  - url: 'https://git.kernel.org/stable/c/37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/882b8912b7e92341fdb115ba0e2e5142a28684ff'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/96f44d493c280ea161569c43d7ed0f3b0815803a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.976Z'
epss: 0.00161
epssPercentile: 0.05771
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: BPF: Refactor jump offset calculation in tail call

The old macro-based jmp_offset calculation derives the jump distance
from a stale prior-pass code stride, which can lead to wrong branch
offsets and soft lockups under extra JIT passes.

Fix this by calculating the offset directly on the absolute target:
"ctx->offset[insn + 1] - ctx->idx".

To avoid a false 16-bit range check abort during size estimation, add
a "ctx->image == NULL" guard to inject a safe dummy offset.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.