Riskcovery

CVE-2026-92486

bpf: Fix CFI mismatch in task work callback

State
Published
Severity
Not scored
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 16, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix CFI mismatch in task work callback

BPF subprograms use the bpf_callback_t ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI.

Store and invoke the callback as bpf_callback_t.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 38aa7003e369802f81a078f6673d10d97013f04f to before 85a33c910edc3651f68b17ae3c597c012545958fAffected
  • 38aa7003e369802f81a078f6673d10d97013f04f to before a2cbab47f44e9ea8c5a161ecba1b6bb8535771ebAffected
  • 38aa7003e369802f81a078f6673d10d97013f04f to before 2805abd089576799b15092949420e3f8ba97fabdAffected
LinuxLinux
  • 6.18Affected
  • before 6.18Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.