CVE-2026-92485 (GCVE-0-2026-92485)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:10 – Updated: 2026-09-18 17:55
VLAI
Title
bpf: Fix WARNING in bpf_tracing_link_release
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARNING in bpf_tracing_link_release The trampoline could be corrupted by the blindly 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier. 1. A fexit attached to a tail_call_reachable prog. 'tr->flags' became 'BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX'. And, the trampoline would poke the target prog's nop insn using jmp insn instead of call insn. 2. Another fexit loaded with the same tail_call_reachable prog target. 'tr->flags' became 'BPF_TRAMP_F_TAIL_CALL_CTX'. 3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in 'tr->flags', the trampoline will fail to restore the prog's nop insn using call insn. [ 3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98 ... [ 3.428793] bpf_link_free+0x58/0x130 [ 3.429293] bpf_link_release+0x23/0x30 Fix the warning by updating 'tr->flags' with '|=' and lock.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 , < 48a0209d8da0d90a7b0a0db19d1ff88027b13781 (git)
Affected: 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 , < 61aaa8782bec59ecffd22e030f54ef9351bcabf9 (git)
Affected: 605c8d8f9966fcd2f0b858fabebe416fc83f2209 (git)
Affected: 028480eaf2a1401e914a1fa1a4a21d877cf0ae30 (git)
Affected: 8f873cc3f67f2257493063e57d0caf07ef889ee9 (git)
Affected: 6.1.72 , < 6.2 (semver)
Affected: 6.5.12 , < 6.6 (semver)
Affected: 6.6.2 , < 6.7 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/trampoline.c",
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "48a0209d8da0d90a7b0a0db19d1ff88027b13781",
              "status": "affected",
              "version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
              "versionType": "git"
            },
            {
              "lessThan": "61aaa8782bec59ecffd22e030f54ef9351bcabf9",
              "status": "affected",
              "version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "605c8d8f9966fcd2f0b858fabebe416fc83f2209",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "028480eaf2a1401e914a1fa1a4a21d877cf0ae30",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8f873cc3f67f2257493063e57d0caf07ef889ee9",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.72",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6",
              "status": "affected",
              "version": "6.5.12",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/trampoline.c",
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix WARNING in bpf_tracing_link_release\n\nThe trampoline could be corrupted by the blindly\n\u0027tr-\u003eflags = BPF_TRAMP_F_TAIL_CALL_CTX\u0027 in verifier.\n\n1. A fexit attached to a tail_call_reachable prog. \u0027tr-\u003eflags\u0027 became\n   \u0027BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX\u0027. And, the\n   trampoline would poke the target prog\u0027s nop insn using jmp insn instead\n   of call insn.\n2. Another fexit loaded with the same tail_call_reachable prog target.\n   \u0027tr-\u003eflags\u0027 became \u0027BPF_TRAMP_F_TAIL_CALL_CTX\u0027.\n3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in\n   \u0027tr-\u003eflags\u0027, the trampoline will fail to restore the prog\u0027s nop insn\n   using call insn.\n\n[    3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98\n...\n[    3.428793]  bpf_link_free+0x58/0x130\n[    3.429293]  bpf_link_release+0x23/0x30\n\nFix the warning by updating \u0027tr-\u003eflags\u0027 with \u0027|=\u0027 and lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The trigger is local bpf() only: BPF_PROG_LOAD of a tail_call_reachable target plus two BPF_TRACE_FEXIT programs (check_attach_btf_id overwrites tr-\u003eflags), BPF_LINK_CREATE via bpf_tracing_prog_attach, then close() of the first link into bpf_tracing_link_release. No remote protocol carries the malformed state.\nAC:L - After the first fexit attach, bpf_trampoline_update sets BPF_TRAMP_F_CALL_ORIG and bpf_arch_text_poke installs a JMP (bpf_trampoline_use_jmp). A second BPF_PROG_LOAD then does tr-\u003eflags = BPF_TRAMP_F_TAIL_CALL_CTX in check_attach_btf_id; closing the first link hits the JMP-vs-CALL mismatch. The attacker owns both loads and the close; CONFIG_DYNAMIC_FTRACE_WITH_JMP is def_bool y on x86_64.\nPR:L - bpf_prog_load() of BPF_PROG_TYPE_TRACING/BPF_TRACE_FEXIT requires CAP_BPF and, via is_perfmon_prog_type(), CAP_PERFMON; bpf_token_capable() with a delegated BPF token grants those into a non-init user namespace, so this is not init-namespace root.\nUI:N - The attacker loads both fexit programs, attaches the first with BPF_LINK_CREATE/bpf_tracing_prog_attach, and closes that link fd themselves; no victim mount, open, or other action is required.\nS:U - The leftover JMP in the target program and the use-after-free of fexit1\u0027s JIT image stay inside host kernel BPF trampoline code; they do not cross a VM, IOMMU, or sandbox boundary.\nC:H - Failed bpf_trampoline_unlink_prog() leaves the target\u0027s 5-byte slot as a JMP into the trampoline image that still calls fexit1-\u003ebpf_func, while bpf_link_free()\u2192bpf_link_dealloc() immediately bpf_prog_put()s fexit1 (no dealloc_deferred). After bpf_jit_free(), later target invocations read that freed executable image.\nI:H - The same dangling trampoline CALL into fexit1\u0027s freed JIT pages is an executable use-after-free; the attacker controls the fexit program and can spray replacement JIT text at that address, hijacking kernel control flow when the target program runs.\nA:H - bpf_tracing_link_release() WARN_ON_ONCE()s the failed bpf_trampoline_unlink_prog() after bpf_arch_text_poke() rejects the JMP-vs-CALL restore. Running the target afterward jumps to the trampoline and calls the freed fexit JIT, causing a kernel paging fault/oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:55:25.436Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/48a0209d8da0d90a7b0a0db19d1ff88027b13781"
        },
        {
          "url": "https://git.kernel.org/stable/c/61aaa8782bec59ecffd22e030f54ef9351bcabf9"
        }
      ],
      "title": "bpf: Fix WARNING in bpf_tracing_link_release",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-92485",
    "datePublished": "2026-09-17T16:10:00.999Z",
    "dateReserved": "2026-09-16T12:21:13.870Z",
    "dateUpdated": "2026-09-18T17:55:25.436Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-92485",
      "date": "2026-09-29",
      "epss": "0.00165",
      "percentile": "0.05072"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/bpf.h",
                  "kernel/bpf/trampoline.c",
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "48a0209d8da0d90a7b0a0db19d1ff88027b13781",
                    "status": "affected",
                    "version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "61aaa8782bec59ecffd22e030f54ef9351bcabf9",
                    "status": "affected",
                    "version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "605c8d8f9966fcd2f0b858fabebe416fc83f2209",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "028480eaf2a1401e914a1fa1a4a21d877cf0ae30",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "8f873cc3f67f2257493063e57d0caf07ef889ee9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "affected",
                    "version": "6.1.72",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "affected",
                    "version": "6.5.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "affected",
                    "version": "6.6.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/bpf.h",
                  "kernel/bpf/trampoline.c",
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix WARNING in bpf_tracing_link_release\n\nThe trampoline could be corrupted by the blindly\n\u0027tr-\u003eflags = BPF_TRAMP_F_TAIL_CALL_CTX\u0027 in verifier.\n\n1. A fexit attached to a tail_call_reachable prog. \u0027tr-\u003eflags\u0027 became\n   \u0027BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX\u0027. And, the\n   trampoline would poke the target prog\u0027s nop insn using jmp insn instead\n   of call insn.\n2. Another fexit loaded with the same tail_call_reachable prog target.\n   \u0027tr-\u003eflags\u0027 became \u0027BPF_TRAMP_F_TAIL_CALL_CTX\u0027.\n3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in\n   \u0027tr-\u003eflags\u0027, the trampoline will fail to restore the prog\u0027s nop insn\n   using call insn.\n\n[    3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98\n...\n[    3.428793]  bpf_link_free+0x58/0x130\n[    3.429293]  bpf_link_release+0x23/0x30\n\nFix the warning by updating \u0027tr-\u003eflags\u0027 with \u0027|=\u0027 and lock."
          }
        ],
        "id": "CVE-2026-92485",
        "lastModified": "2026-09-18T18:18:12.610",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:50.590",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/48a0209d8da0d90a7b0a0db19d1ff88027b13781"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/61aaa8782bec59ecffd22e030f54ef9351bcabf9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-22T16:27:08Z",
      "cve": "CVE-2026-92485",
      "id": "CVE-2026-92485",
      "initial_release_date": "2026-09-18T00:13:52Z",
      "product_status:known_affected": "80",
      "product_status:known_not_affected": "267",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-92485",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-92485.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.