CVE-2026-99092— RISC-V BPF JIT 执行内存地址处理漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Linux 内核中，以下漏洞已被修复： riscv: patch: 修复对 bpf-jit 执行内存地址的处理 提交 8718e5a3090b（"riscv: patch: 当内核文本已可写时跳过 fixmap 映射"）将 中 分支的执行条件限制为 ，并明确保留了 分支不变。然而，该分支存在另一个独立问题。 该分支仅在启用 时才会创建一个临时的可写 fixmap 别名；否则，它假设目标地址直接可写，并原样返回该地址。但这一假设现已不再成立： 在 中无条件地对每个 pack 调用 ，无论任何 选项是否启用。因此，
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-99092 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
riscv: patch: fix handling of bpf-jit execmem addresses
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
riscv: patch: fix handling of bpf-jit execmem addresses
Commit 8718e5a3090b ("riscv: patch: skip fixmap mapping when kernel text
is already writable") gated the core_kernel_text() branch of patch_map()
on CONFIG_STRICT_KERNEL_RWX, and explicitly left the vmalloc branch
unchanged. That branch has a separate problem.
That branch only creates a temporary writable fixmap alias when
CONFIG_STRICT_MODULE_RWX is enabled, and otherwise assumes the target is
directly writable and returns the address unchanged. That assumption no
longer holds: bpf_prog_pack_alloc calls set_memory_rox() on every pack
unconditionally in alloc_new_pack(), independently of any
CONFIG_STRICT_*_RWX option, so BPF text in the vmalloc area is read-only
regardless of what CONFIG_STRICT_MODULE_RWX says.
With CONFIG_STRICT_MODULE_RWX=n, patch_map() returns the read-only
address directly, the subsequent copy_to_kernel_nofault() takes a
page fault and returns -EFAULT. bpf_arch_text_copy() turns that into
-EINVAL, which propagates through bpf_jit_binary_pack_finalize() to the
WARN_ON() in bpf_int_jit_compile() and leaves the program un-JITed.
Note that BPF cannot be fixed the way kprobes was in
commit bdc46e507b59 ("riscv: mm: make EXECMEM_KPROBES writable without
CONFIG_STRICT_MODULE_RWX"). EXECMEM_BPF is already PAGE_KERNEL, i.e.
writable at allocation time; the read-only mapping is established
afterwards by generic code in alloc_new_pack(), which arch code cannot
influence. The only place this can be handled is patch_map().
This is the same problem that was fixed on arm64 by commit b1480ed230ac
("arm64: patching: fix handling of execmem addresses"), and the fix is
the same: CONFIG_EXECMEM is what actually tracks whether the vmalloc
area can hold executable memory that needs a temporary alias to be
written. CONFIG_BPF_JIT, CONFIG_KPROBES and CONFIG_MODULES all select
it.
Note that this is not limited to CONFIG_MODULES=n. Unlike arm64, riscv
selects CONFIG_ARCH_OPTIONAL_KERNEL_RWX, so CONFIG_STRICT_MODULE_RWX can
be disabled with CONFIG_MODULES=y as well, and the bug is reachable in
that configuration too.
The !CONFIG_MMU build is unaffected: it has its own __patch_insn_set()
and __patch_insn_write() implementations and never calls patch_map().
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-99092 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-99092 的情报信息
请登录查看更多情报信息。
CVE-2026-99092 补丁与修复 (3)
同批安全公告 · Linux · 2026-10-26 · 共 12 条
| CVE-2026-99099 | x86/CPU/AMD TLBI 错误#1718 修复 | |
| CVE-2026-99097 | TEE 动态共享内存分配零大小拒绝漏洞 | |
| CVE-2026-99098 | dm-integrity 内联模式缓冲区溢出漏洞 | |
| CVE-2026-99095 | V3D drm/vc4 驱动未绑定资源释放漏洞 | |
| CVE-2026-99096 | Linux io_uring 权限绕过漏洞 | |
| CVE-2026-99094 | Linux 蓝牙驱动 btintel_pcie 越界漏洞 | |
| CVE-2026-99093 | Linux 内核启动时延迟页表释放调度漏洞 | |
| CVE-2026-99090 | amdgpu GPU 重置期间 vblank 计数器序列化竞争漏洞 | |
| CVE-2026-99091 | 蓝牙 MGMT 电源关闭时命令状态修复漏洞 | |
| CVE-2026-99089 | ASoC 三星 I2S 运行时电源管理不平衡漏洞 | |
| CVE-2026-99088 | Open vSwitch 验证 IPv6 地址传输头漏洞 |