CVE-2026-92485

bpf: Fix WARNING in bpf_tracing_link_release

State: Published
Severity: 7.8 High
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix WARNING in bpf_tracing_link_release

The trampoline could be corrupted by the blindly 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier.

1. A fexit attached to a tail_call_reachable prog. 'tr->flags' became 'BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX'. And, the trampoline would poke the target prog's nop insn using jmp insn instead of call insn. 2. Another fexit loaded with the same tail_call_reachable prog target. 'tr->flags' became 'BPF_TRAMP_F_TAIL_CALL_CTX'. 3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in 'tr->flags', the trampoline will fail to restore the prog's nop insn using call insn.

[ 3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98 ... [ 3.428793] bpf_link_free+0x58/0x130 [ 3.429293] bpf_link_release+0x23/0x30

Fix the warning by updating 'tr->flags' with '|=' and lock.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	605c8d8f9966fcd2f0b858fabebe416fc83f2209 to before 1757598b3804f7cb35b5b5e02558f6d8b9c2f254Affected 8f873cc3f67f2257493063e57d0caf07ef889ee9 to before a5c6316052f0ff1467221ecf2996cbab0a496b1eAffected 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 to before d02035c5eb4955616efc5c6dbe3d98f19d798cb2Affected 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 to before 094f0a895cf97a993d06d5dc4c12e7cb7da845a5Affected 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 to before 48a0209d8da0d90a7b0a0db19d1ff88027b13781Affected 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 to before 61aaa8782bec59ecffd22e030f54ef9351bcabf9Affected 028480eaf2a1401e914a1fa1a4a21d877cf0ae30Affected 6.1.72 to before 6.1.191Affected 6.6.2 to before 6.6.160Affected 6.5.12 to before 6.6Affected
LinuxLinux	6.7Affected before 6.7Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

605c8d8f9966fcd2f0b858fabebe416fc83f2209 to before 1757598b3804f7cb35b5b5e02558f6d8b9c2f254Affected
8f873cc3f67f2257493063e57d0caf07ef889ee9 to before a5c6316052f0ff1467221ecf2996cbab0a496b1eAffected
2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 to before d02035c5eb4955616efc5c6dbe3d98f19d798cb2Affected
2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 to before 094f0a895cf97a993d06d5dc4c12e7cb7da845a5Affected
2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 to before 48a0209d8da0d90a7b0a0db19d1ff88027b13781Affected
2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 to before 61aaa8782bec59ecffd22e030f54ef9351bcabf9Affected
028480eaf2a1401e914a1fa1a4a21d877cf0ae30Affected
6.1.72 to before 6.1.191Affected
6.6.2 to before 6.6.160Affected
6.5.12 to before 6.6Affected

LinuxLinux

6.7Affected
before 6.7Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.