---
id: CVE-2026-92518
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  riscv, bpf: Fix kernel stack corruption in tailcall with CFI

  When CONFIG_CFI_CLANG is enabled, prog->bpf_func already skips the kcfi
  instruction during setup
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  riscv, bpf: Fix kernel stack corruption in tailcall with CFI

  When CONFIG_CFI_CLANG is enabled, prog->bpf_func already skips the kcfi
  instruction during setup. Includin…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 30a59cc79754fd9ff3f41b7ee2eb21da85988548 <
    34b1bb33a025787e05f966e74de18cd36276f801
  - >-
    Linux >= 30a59cc79754fd9ff3f41b7ee2eb21da85988548 <
    a6e11a81da3420fd37f1518d4f238c4d5784086e
  - >-
    Linux >= 30a59cc79754fd9ff3f41b7ee2eb21da85988548 <
    52fb1756ea1d2759dfef2d86245be00b05dac3a2
  - Linux fe5b68fdcec0f3d97a32f4c4acfef59cf90718f7
  - Linux >= 6.11.6 < 6.12
  - Linux 6.12
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:18:13.997'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92518'
references:
  - url: 'https://git.kernel.org/stable/c/34b1bb33a025787e05f966e74de18cd36276f801'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/52fb1756ea1d2759dfef2d86245be00b05dac3a2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a6e11a81da3420fd37f1518d4f238c4d5784086e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00162
epssPercentile: 0.05781
ingestedAt: '2026-09-17T16:21:47.777Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

riscv, bpf: Fix kernel stack corruption in tailcall with CFI

When CONFIG_CFI_CLANG is enabled, prog->bpf_func already skips the kcfi
instruction during setup. Including it again in the tailcall jump offset
causes it to jump over an extra 4 bytes, skipping the stack pointer
adjustment, which will result in kernel stack corruption.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.