CVE-2026-89906

LoongArch: BPF: Refactor jump offset calculation in tail call

State: Published
Severity: 7.8 High
Published: Sep 16, 2026
Updated: Oct 21, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: BPF: Refactor jump offset calculation in tail call

The old macro-based jmp_offset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under extra JIT passes.

Fix this by calculating the offset directly on the absolute target: "ctx->offset[insn + 1] - ctx->idx".

To avoid a false 16-bit range check abort during size estimation, add a "ctx->image == NULL" guard to inject a safe dummy offset.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	17c010fe45def335fe03a0718935416b04c7f349 to before 50fbc294e4e96246d60cd66f98acf043a362e3a0Affected f83d469e16bb1f75991ca67c56786fb2aaa42bea to before 89819868cde78cb2f748533785a46a3430873f20Affected cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 to before 882b8912b7e92341fdb115ba0e2e5142a28684ffAffected cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 to before 96f44d493c280ea161569c43d7ed0f3b0815803aAffected cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 to before 37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8Affected 1a782fa32e644aa9fbae6c8488f3e61221ac96e1Affected f2b5e50cc04d7a049b385bc1c93b9cbf5f10c94fAffected 9262e3e04621558e875eb5afb5e726b648cd5949Affected 6.6.103 to before 6.6.160Affected 6.12.43 to before 6.12.114Affected 6.1.149 to before 6.2Affected 6.15.11 to before 6.16Affected 6.16.2 to before 6.17Affected
LinuxLinux	6.17Affected before 6.17Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

17c010fe45def335fe03a0718935416b04c7f349 to before 50fbc294e4e96246d60cd66f98acf043a362e3a0Affected
f83d469e16bb1f75991ca67c56786fb2aaa42bea to before 89819868cde78cb2f748533785a46a3430873f20Affected
cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 to before 882b8912b7e92341fdb115ba0e2e5142a28684ffAffected
cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 to before 96f44d493c280ea161569c43d7ed0f3b0815803aAffected
cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 to before 37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8Affected
1a782fa32e644aa9fbae6c8488f3e61221ac96e1Affected
f2b5e50cc04d7a049b385bc1c93b9cbf5f10c94fAffected
9262e3e04621558e875eb5afb5e726b648cd5949Affected
6.6.103 to before 6.6.160Affected
6.12.43 to before 6.12.114Affected
6.1.149 to before 6.2Affected
6.15.11 to before 6.16Affected
6.16.2 to before 6.17Affected

LinuxLinux

6.17Affected
before 6.17Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.