CVE-2026-99092— riscv: patch: fix handling of bpf-jit execmem addresses

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已被修复： riscv: patch: 修复对 bpf-jit 执行内存地址的处理提交 8718e5a3090b（"riscv: patch: 当内核文本已可写时跳过 fixmap 映射"）将中分支的执行条件限制为，并明确保留了分支不变。然而，该分支存在另一个独立问题。该分支仅在启用时才会创建一个临时的可写 fixmap 别名；否则，它假设目标地址直接可写，并原样返回该地址。但这一假设现已不再成立：在中无条件地对每个 pack 调用，无论任何选项是否启用。因此，

AI Predicted 5.9 Difficulty: Hard Updated Oct 26, 2026

Possible ATT&CK Techniques 3 AI

T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application T1055.001 · Dynamic-link Library Injection

Updated Oct 26, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

riscv: patch: fix handling of bpf-jit execmem addresses

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: riscv: patch: fix handling of bpf-jit execmem addresses Commit 8718e5a3090b ("riscv: patch: skip fixmap mapping when kernel text is already writable") gated the core_kernel_text() branch of patch_map() on CONFIG_STRICT_KERNEL_RWX, and explicitly left the vmalloc branch unchanged. That branch has a separate problem. That branch only creates a temporary writable fixmap alias when CONFIG_STRICT_MODULE_RWX is enabled, and otherwise assumes the target is directly writable and returns the address unchanged. That assumption no longer holds: bpf_prog_pack_alloc calls set_memory_rox() on every pack unconditionally in alloc_new_pack(), independently of any CONFIG_STRICT_*_RWX option, so BPF text in the vmalloc area is read-only regardless of what CONFIG_STRICT_MODULE_RWX says. With CONFIG_STRICT_MODULE_RWX=n, patch_map() returns the read-only address directly, the subsequent copy_to_kernel_nofault() takes a page fault and returns -EFAULT. bpf_arch_text_copy() turns that into -EINVAL, which propagates through bpf_jit_binary_pack_finalize() to the WARN_ON() in bpf_int_jit_compile() and leaves the program un-JITed. Note that BPF cannot be fixed the way kprobes was in commit bdc46e507b59 ("riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX"). EXECMEM_BPF is already PAGE_KERNEL, i.e. writable at allocation time; the read-only mapping is established afterwards by generic code in alloc_new_pack(), which arch code cannot influence. The only place this can be handled is patch_map(). This is the same problem that was fixed on arm64 by commit b1480ed230ac ("arm64: patching: fix handling of execmem addresses"), and the fix is the same: CONFIG_EXECMEM is what actually tracks whether the vmalloc area can hold executable memory that needs a temporary alias to be written. CONFIG_BPF_JIT, CONFIG_KPROBES and CONFIG_MODULES all select it. Note that this is not limited to CONFIG_MODULES=n. Unlike arm64, riscv selects CONFIG_ARCH_OPTIONAL_KERNEL_RWX, so CONFIG_STRICT_MODULE_RWX can be disabled with CONFIG_MODULES=y as well, and the bug is reachable in that configuration too. The !CONFIG_MMU build is unaffected: it has its own __patch_insn_set() and __patch_insn_write() implementations and never calls patch_map().

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	2c9e5d4a008293407836d29d35dfd4353615bd2f ~ 562a35b9e0b3d9483d9472995219cadb3592db3d	-
Linux	Linux	6.10	-

II. Public POCs for CVE-2026-99092

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99092

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99092 (3)

https://www.cve.org/CVERecord?id=CVE-2026-99092

Same Patch Batch · Linux · 2026-10-26 · 12 CVEs total

CVE-2026-99099		x86/CPU/AMD: Fix AMD TLBI Erratum #1718
CVE-2026-99097		tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
CVE-2026-99098		dm-integrity: fix buffer overflow in inline mode with large tag size
CVE-2026-99095		drm/vc4: drain the hangcheck timer and works on V3D unbind
CVE-2026-99096		io_uring/register: don't exempt disabled rings from task restrictions
CVE-2026-99094		Bluetooth: btintel_pcie: fix TX descriptor bounds check
CVE-2026-99093		mm: don't schedule deferred kernel page table freeing while booting
CVE-2026-99090		drm/amdgpu: serialize vblank counter reads against GPU reset
CVE-2026-99091		Bluetooth: MGMT: Fix status of pending commands flushed on power off
CVE-2026-99089		ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
CVE-2026-99088		net: openvswitch: validate transport header presence in set_ipv6_addr

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux