Vulnerability-Lookup

GHSA-HHJV-QJ57-F47F

Vulnerability from github – Published: 2026-09-17 18:32 – Updated: 2026-10-30 15:33

Details

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix WARNING in bpf_tracing_link_release

The trampoline could be corrupted by the blindly 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier.

A fexit attached to a tail_call_reachable prog. 'tr->flags' became 'BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX'. And, the trampoline would poke the target prog's nop insn using jmp insn instead of call insn.
Another fexit loaded with the same tail_call_reachable prog target. 'tr->flags' became 'BPF_TRAMP_F_TAIL_CALL_CTX'.
Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in 'tr->flags', the trampoline will fail to restore the prog's nop insn using call insn.

[ 3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98 ... [ 3.428793] bpf_link_free+0x58/0x130 [ 3.429293] bpf_link_release+0x23/0x30

Fix the warning by updating 'tr->flags' with '|=' and lock.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-92485"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-17T17:17:50Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix WARNING in bpf_tracing_link_release\n\nThe trampoline could be corrupted by the blindly\n\u0027tr-\u003eflags = BPF_TRAMP_F_TAIL_CALL_CTX\u0027 in verifier.\n\n1. A fexit attached to a tail_call_reachable prog. \u0027tr-\u003eflags\u0027 became\n   \u0027BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX\u0027. And, the\n   trampoline would poke the target prog\u0027s nop insn using jmp insn instead\n   of call insn.\n2. Another fexit loaded with the same tail_call_reachable prog target.\n   \u0027tr-\u003eflags\u0027 became \u0027BPF_TRAMP_F_TAIL_CALL_CTX\u0027.\n3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in\n   \u0027tr-\u003eflags\u0027, the trampoline will fail to restore the prog\u0027s nop insn\n   using call insn.\n\n[    3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98\n...\n[    3.428793]  bpf_link_free+0x58/0x130\n[    3.429293]  bpf_link_release+0x23/0x30\n\nFix the warning by updating \u0027tr-\u003eflags\u0027 with \u0027|=\u0027 and lock.",
  "id": "GHSA-hhjv-qj57-f47f",
  "modified": "2026-10-30T15:33:39Z",
  "published": "2026-09-17T18:32:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92485"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/094f0a895cf97a993d06d5dc4c12e7cb7da845a5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1757598b3804f7cb35b5b5e02558f6d8b9c2f254"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/48a0209d8da0d90a7b0a0db19d1ff88027b13781"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/61aaa8782bec59ecffd22e030f54ef9351bcabf9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a5c6316052f0ff1467221ecf2996cbab0a496b1e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d02035c5eb4955616efc5c6dbe3d98f19d798cb2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-92485 (GCVE-0-2026-92485)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:10 – Updated: 2026-10-30 12:35

Title

bpf: Fix WARNING in bpf_tracing_link_release

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARNING in bpf_tracing_link_release The trampoline could be corrupted by the blindly 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier. 1. A fexit attached to a tail_call_reachable prog. 'tr->flags' became 'BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX'. And, the trampoline would poke the target prog's nop insn using jmp insn instead of call insn. 2. Another fexit loaded with the same tail_call_reachable prog target. 'tr->flags' became 'BPF_TRAMP_F_TAIL_CALL_CTX'. 3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in 'tr->flags', the trampoline will fail to restore the prog's nop insn using call insn. [ 3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98 ... [ 3.428793] bpf_link_free+0x58/0x130 [ 3.429293] bpf_link_release+0x23/0x30 Fix the warning by updating 'tr->flags' with '|=' and lock.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

6 references

URL	Tags
https://git.kernel.org/stable/c/1757598b3804f7cb3…
https://git.kernel.org/stable/c/a5c6316052f0ff146…
https://git.kernel.org/stable/c/d02035c5eb4955616…
https://git.kernel.org/stable/c/094f0a895cf97a993…
https://git.kernel.org/stable/c/48a0209d8da0d90a7…
https://git.kernel.org/stable/c/61aaa8782bec59ecf…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 605c8d8f9966fcd2f0b858fabebe416fc83f2209 , < 1757598b3804f7cb35b5b5e02558f6d8b9c2f254 (git) Affected: 8f873cc3f67f2257493063e57d0caf07ef889ee9 , < a5c6316052f0ff1467221ecf2996cbab0a496b1e (git) Affected: 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 , < d02035c5eb4955616efc5c6dbe3d98f19d798cb2 (git) Affected: 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 , < 094f0a895cf97a993d06d5dc4c12e7cb7da845a5 (git) Affected: 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 , < 48a0209d8da0d90a7b0a0db19d1ff88027b13781 (git) Affected: 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 , < 61aaa8782bec59ecffd22e030f54ef9351bcabf9 (git) Affected: 028480eaf2a1401e914a1fa1a4a21d877cf0ae30 (git) Affected: 6.1.72 , < 6.1.191 (semver) Affected: 6.6.2 , < 6.6.160 (semver) Affected: 6.5.12 , < 6.6 (semver)
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.114 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/trampoline.c",
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1757598b3804f7cb35b5b5e02558f6d8b9c2f254",
              "status": "affected",
              "version": "605c8d8f9966fcd2f0b858fabebe416fc83f2209",
              "versionType": "git"
            },
            {
              "lessThan": "a5c6316052f0ff1467221ecf2996cbab0a496b1e",
              "status": "affected",
              "version": "8f873cc3f67f2257493063e57d0caf07ef889ee9",
              "versionType": "git"
            },
            {
              "lessThan": "d02035c5eb4955616efc5c6dbe3d98f19d798cb2",
              "status": "affected",
              "version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
              "versionType": "git"
            },
            {
              "lessThan": "094f0a895cf97a993d06d5dc4c12e7cb7da845a5",
              "status": "affected",
              "version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
              "versionType": "git"
            },
            {
              "lessThan": "48a0209d8da0d90a7b0a0db19d1ff88027b13781",
              "status": "affected",
              "version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
              "versionType": "git"
            },
            {
              "lessThan": "61aaa8782bec59ecffd22e030f54ef9351bcabf9",
              "status": "affected",
              "version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "028480eaf2a1401e914a1fa1a4a21d877cf0ae30",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.191",
              "status": "affected",
              "version": "6.1.72",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.160",
              "status": "affected",
              "version": "6.6.2",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6",
              "status": "affected",
              "version": "6.5.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/trampoline.c",
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "6.1.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "6.6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix WARNING in bpf_tracing_link_release\n\nThe trampoline could be corrupted by the blindly\n\u0027tr-\u003eflags = BPF_TRAMP_F_TAIL_CALL_CTX\u0027 in verifier.\n\n1. A fexit attached to a tail_call_reachable prog. \u0027tr-\u003eflags\u0027 became\n   \u0027BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX\u0027. And, the\n   trampoline would poke the target prog\u0027s nop insn using jmp insn instead\n   of call insn.\n2. Another fexit loaded with the same tail_call_reachable prog target.\n   \u0027tr-\u003eflags\u0027 became \u0027BPF_TRAMP_F_TAIL_CALL_CTX\u0027.\n3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in\n   \u0027tr-\u003eflags\u0027, the trampoline will fail to restore the prog\u0027s nop insn\n   using call insn.\n\n[    3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98\n...\n[    3.428793]  bpf_link_free+0x58/0x130\n[    3.429293]  bpf_link_release+0x23/0x30\n\nFix the warning by updating \u0027tr-\u003eflags\u0027 with \u0027|=\u0027 and lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The trigger is local bpf() only: BPF_PROG_LOAD of a tail_call_reachable target plus two BPF_TRACE_FEXIT programs (check_attach_btf_id overwrites tr-\u003eflags), BPF_LINK_CREATE via bpf_tracing_prog_attach, then close() of the first link into bpf_tracing_link_release. No remote protocol carries the malformed state.\nAC:L - After the first fexit attach, bpf_trampoline_update sets BPF_TRAMP_F_CALL_ORIG and bpf_arch_text_poke installs a JMP (bpf_trampoline_use_jmp). A second BPF_PROG_LOAD then does tr-\u003eflags = BPF_TRAMP_F_TAIL_CALL_CTX in check_attach_btf_id; closing the first link hits the JMP-vs-CALL mismatch. The attacker owns both loads and the close; CONFIG_DYNAMIC_FTRACE_WITH_JMP is def_bool y on x86_64.\nPR:L - bpf_prog_load() of BPF_PROG_TYPE_TRACING/BPF_TRACE_FEXIT requires CAP_BPF and, via is_perfmon_prog_type(), CAP_PERFMON; bpf_token_capable() with a delegated BPF token grants those into a non-init user namespace, so this is not init-namespace root.\nUI:N - The attacker loads both fexit programs, attaches the first with BPF_LINK_CREATE/bpf_tracing_prog_attach, and closes that link fd themselves; no victim mount, open, or other action is required.\nS:U - The leftover JMP in the target program and the use-after-free of fexit1\u0027s JIT image stay inside host kernel BPF trampoline code; they do not cross a VM, IOMMU, or sandbox boundary.\nC:H - Failed bpf_trampoline_unlink_prog() leaves the target\u0027s 5-byte slot as a JMP into the trampoline image that still calls fexit1-\u003ebpf_func, while bpf_link_free()\u2192bpf_link_dealloc() immediately bpf_prog_put()s fexit1 (no dealloc_deferred). After bpf_jit_free(), later target invocations read that freed executable image.\nI:H - The same dangling trampoline CALL into fexit1\u0027s freed JIT pages is an executable use-after-free; the attacker controls the fexit program and can spray replacement JIT text at that address, hijacking kernel control flow when the target program runs.\nA:H - bpf_tracing_link_release() WARN_ON_ONCE()s the failed bpf_trampoline_unlink_prog() after bpf_arch_text_poke() rejects the JMP-vs-CALL restore. Running the target afterward jumps to the trampoline and calls the freed fexit JIT, causing a kernel paging fault/oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:35:38.840Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1757598b3804f7cb35b5b5e02558f6d8b9c2f254"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5c6316052f0ff1467221ecf2996cbab0a496b1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/d02035c5eb4955616efc5c6dbe3d98f19d798cb2"
        },
        {
          "url": "https://git.kernel.org/stable/c/094f0a895cf97a993d06d5dc4c12e7cb7da845a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/48a0209d8da0d90a7b0a0db19d1ff88027b13781"
        },
        {
          "url": "https://git.kernel.org/stable/c/61aaa8782bec59ecffd22e030f54ef9351bcabf9"
        }
      ],
      "title": "bpf: Fix WARNING in bpf_tracing_link_release",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-92485",
    "datePublished": "2026-09-17T16:10:00.999Z",
    "dateReserved": "2026-09-16T12:21:13.870Z",
    "dateUpdated": "2026-10-30T12:35:38.840Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted