CVE-2026-99092
Low risk· EPSS 6%Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel on RISC-V, patch_map() incorrectly assumes vmalloc addresses are directly writable when CONFIG_STRICT_MODULE_RWX is disabled. Since BPF marks its text read-only via set_memory_rox() regardless, the write triggers a page fault and returns -EFAULT, preventing JIT compilation of BPF programs and triggering WARN_ON().
Risk Assessment
On RISC-V configurations with CONFIG_STRICT_MODULE_RWX disabled (also possible with CONFIG_MODULES=y), BPF programs cannot be JIT-compiled, potentially causing kernel warnings and degraded performance or failures in BPF-based mechanisms.
Recommendation
Update the kernel to a version containing the fix that checks CONFIG_EXECMEM instead of CONFIG_STRICT_MODULE_RWX in patch_map(). Until then, avoid RISC-V configurations with CONFIG_STRICT_MODULE_RWX disabled if BPF JIT is in use.
Other vulnerabilities in Linux kernel
See all- CVE-2026-43603Medium
A NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel crash. This may result in a denial of service on the affected system.
- CVE-2026-99270High
A use-after-free (UAF) vulnerability exists in the Linux kernel's reqsk_timer_handler() function. When TCP socket migration fails at inet_ehash_insert(), the code jumps to the no_ownership label and immediately frees the new reqsk via __reqsk_free() without stopping its timer, potentially leading to a UAF.
- CVE-2026-99269High
In the Linux kernel sched_ext scheduler, a task can be found on a non-local DSQ while the CPU that dispatched it is still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING. The DSQ consume and move paths don't wait for dispatch to finish and can operate on the task concurrently with the dispatcher. The fix adds scx_wait_dispatching() before operating on the task.
- CVE-2026-99268Unknown
In io_uring with IORING_SETUP_DEFER_TASKRUN, completions are queued as local work and only become CQEs when the submitter enters the kernel to wait for events. io_uring_poll() reports EPOLLIN if local work is pending, but only if the work exists at call time; after DEFER_TASKRUN was added, the ->poll_wq wakeup was replaced by directly waking the submitter, so poll() can sleep despite pending work. The fix wakes ->poll_wq when the first entry is put on the work list, using an RCU callback when needed.
- CVE-2026-99267Unknown
In io_uring NAPI with dynamic tracking, a NAPI id not seen for a minute should be dropped from the ring's busy-poll list. However, the timeout is computed incorrectly — SEC_CONVERSION is used instead of the number of jiffies per second, giving about eight years for HZ=1000 and overflowing on 32-bit systems. As a result, entries are never removed and every wait polls all historical ids.
- CVE-2026-99266Unknown
In io_uring zcrx, io_zcrx_queue_cqe() computes the buffer offset in its area from net_iov_idx(), which is an unsigned int, so the shift is done in 32 bits and only the result is widened to the u64 placed in the CQE. An area can be up to 1 TB, so for every niov beyond the first 4 GB the CQE points the application at a buffer 4 GB (or a multiple) below the correct one. The application reads wrong data and returns a buffer it doesn't own via the refill queue while the real one is never given back.
- CVE-2026-99265Unknown
In io_uring/openclose, io_pipe_fixed() installs both ends of the pipe in the fixed file table, drops ->uring_lock, and copies the slot numbers to the application. If that faults, it takes the lock again and removes whatever is in these slots. If the request is run by io-wq, the lock really is dropped and the slots are visible to others; by the time the error path gets to them, they may have been closed and reused (by IORING_OP_CLOSE, direct open/accept, or IORING_REGISTER_FILES_UPDATE), causing removal of a file unrelated to the failed request. The fix performs the copy with the lock held.
- CVE-2026-99264High
A bug was fixed in the Linux kernel's io_uring/net handling of recv retries on uncommitted buffers. When a receive was retried after a partial transfer, the kernel could hand out buffer memory that the retried request was still writing to, causing data overwrites. The request is now completed with the bytes received instead of retried, and MSG_WAITALL is no longer honoured for incremental buffers or multi-buffer bundles.
- CVE-2026-99263Unknown
In io_uring/poll, if a wakeup sets IO_POLL_RETRY_FLAG between the owning task consuming the existing instance of IO_POLL_RETRY_FLAG and the loop check in io_poll_check_events(), request processing stalls until an unrelated wakeup arrives. The fix uses atomic_cmpxchg instead of atomic_sub_return to guarantee both the count v and poll_refs are 0 and no wakeups are missed.
- CVE-2026-99262Unknown
In io_uring/timeout, an IORING_OP_TIMEOUT run by io-wq due to IOSQE_ASYNC has the same problem as poll, futex, and waitid. io_wq_submit_work() checks IO_WQ_WORK_CANCEL only once before issuing the request; a cancel in between flags the work, gets -EALREADY, and searches ->timeout_list in vain while the worker adds the request and starts the timer. Nobody checks the flag again and the timeout runs its course, and at ring exit a task can get stuck for the full duration. The fix checks the flag under ->timeout_lock and fails the request if set.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: riscv: patch: fix handling of bpf-jit execmem addresses Commit 8718e5a3090b ("riscv: patch: skip fixmap mapping when kernel text is already writable") gated the core_kernel_text() branch of patch_map() on CONFIG_STRICT_KERNEL_RWX, and explicitly left the vmalloc branch unchanged. That branch has a separate problem. That branch only creates a temporary writable fixmap alias when CONFIG_STRICT_MODULE_RWX is enabled, and otherwise assumes the target is directly writable and returns the address unchanged. That assumption no longer holds: bpf_prog_pack_alloc calls set_memory_rox() on every pack unconditionally in alloc_new_pack(), independently of any CONFIG_STRICT_*_RWX option, so BPF text in the vmalloc area is read-only regardless of what CONFIG_STRICT_MODULE_RWX says. With CONFIG_STRICT_MODULE_RWX=n, patch_map() returns the read-only address directly, the subsequent copy_to_kernel_nofault() takes a page fault and returns -EFAULT. bpf_arch_text_copy() turns that into -EINVAL, which propagates through bpf_jit_binary_pack_finalize() to the WARN_ON() in bpf_int_jit_compile() and leaves the program un-JITed. Note that BPF cannot be fixed the way kprobes was in commit bdc46e507b59 ("riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX"). EXECMEM_BPF is already PAGE_KERNEL, i.e. writable at allocation time; the read-only mapping is established afterwards by generic code in alloc_new_pack(), which arch code cannot influence. The only place this can be handled is patch_map(). This is the same problem that was fixed on arm64 by commit b1480ed230ac ("arm64: patching: fix handling of execmem addresses"), and the fix is the same: CONFIG_EXECMEM is what actually tracks whether the vmalloc area can hold executable memory that needs a temporary alias to be written. CONFIG_BPF_JIT, CONFIG_KPROBES and CONFIG_MODULES all select it. Note that this is not limited to CONFIG_MODULES=n. Unlike arm64, riscv selects CONFIG_ARCH_OPTIONAL_KERNEL_RWX, so CONFIG_STRICT_MODULE_RWX can be disabled with CONFIG_MODULES=y as well, and the bug is reachable in that configuration too. The !CONFIG_MMU build is unaffected: it has its own __patch_insn_set() and __patch_insn_write() implementations and never calls patch_map().
Vulnerability data from NVD (NIST) · CISA KEV · EPSS