GHSA-GPR4-RP6H-2879
Vulnerability from github – Published: 2026-09-16 12:30 – Updated: 2026-09-16 15:31In the Linux kernel, the following vulnerability has been resolved:
LoongArch: BPF: Refactor jump offset calculation in tail call
The old macro-based jmp_offset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under extra JIT passes.
Fix this by calculating the offset directly on the absolute target: "ctx->offset[insn + 1] - ctx->idx".
To avoid a false 16-bit range check abort during size estimation, add a "ctx->image == NULL" guard to inject a safe dummy offset.
{
"affected": [],
"aliases": [
"CVE-2026-89906"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T11:16:59Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: BPF: Refactor jump offset calculation in tail call\n\nThe old macro-based jmp_offset calculation derives the jump distance\nfrom a stale prior-pass code stride, which can lead to wrong branch\noffsets and soft lockups under extra JIT passes.\n\nFix this by calculating the offset directly on the absolute target:\n\"ctx-\u003eoffset[insn + 1] - ctx-\u003eidx\".\n\nTo avoid a false 16-bit range check abort during size estimation, add\na \"ctx-\u003eimage == NULL\" guard to inject a safe dummy offset.",
"id": "GHSA-gpr4-rp6h-2879",
"modified": "2026-09-16T15:31:01Z",
"published": "2026-09-16T12:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89906"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/882b8912b7e92341fdb115ba0e2e5142a28684ff"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/96f44d493c280ea161569c43d7ed0f3b0815803a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.