{"id":"CVE-2026-89581","revision":null,"records":[{"revision":"c8d64bbd326f44a7981743660ab97f72","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89581","aliases":[],"title":"bpf, x86: Fix per-CPU address resolution into an extended register","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, x86: Fix per-CPU address resolution into an extended register\n\nThe destination of the per-CPU address MOV is encoded in ModRM.reg,\nwhich is extended by REX.R, but the REX prefix is built with\nadd_1mod(), which sets REX.B. REX.B extends ModRM.rm and SIB.base, and\nthis instruction addresses memory as disp32 with no base, so the bit\nhas no effect at all and the high register bit is simply lost.\n\nEvery is_ereg() destination therefore resolves to the wrong register,\npicking whichever one shares the low three bits:\n\n  R5 -> RAX    R7 -> RBP    R8 -> RSI    R9 -> RDI\n\nWith BPF_REG_5, whose reg2hex is 0, the emitted\n\n  65 49 03 04 25 <off>\tadd %gs:<off>,%rax\n\nadds the per-CPU offset to RAX rather than R8. The destination keeps\nthe unadjusted address and RAX is clobbered, so the program goes on to\ndereference a pointer that was never made per-CPU:\n\n  BUG: unable to handle page fault for address: 0000607e386a8894\n  RIP: bpf_prog_707837aafd2aa9ae_update_percpu_data+0x93/0xc9\n  Call Trace:\n   __bpf_prog_test_run_raw_tp+0x2dc/0x7d0\n   __flush_smp_call_function_queue+0x1e9/0xc80\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nR5 is the mildest of the four, aliasing a scratch register and faulting\nat the store. R7 aliases RBP and would corrupt the frame pointer, R8\nand R9 alias the argument registers.\n\nUse add_2mod() so the register goes through REX.R, matching how\nadd_2reg() places it in ModRM.reg and how emit_priv_frame_ptr()\nhardcodes 0x4c for the same instruction with R9. Encodings for the\nnon-extended registers are unchanged.\n\nProblem showed up when trying to resurrect BPF_GCC CI (selftests built\nwith BPF_GCC).\n\nThis has gone unnoticed because clang reloads the address into R1\nbefore each per-CPU access, so the destination is never an extended\nregister. GCC keeps several per-CPU addresses live at once, and\ntest_progs-bpf_gcc panics the kernel in global_percpu_data/init, where\nthe address of a .percpu variable ends up in R5.","state":0,"publishedAt":"2026-09-11T19:44:47.581+00:00","modifiedAt":"2026-10-19T08:49:14.144+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/x86/net/bpf_jit_comp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7bdbf7446305cb65c510c16d57cde82bc76b234a\",\n                            \"lessThan\": \"638bc3aada8ecdece184d5c15b100d489c9cccd7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7bdbf7446305cb65c510c16d57cde82bc76b234a\",\n                            \"lessThan\": \"6886642414f59f928728802dc2c972a9859e6310\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7bdbf7446305cb65c510c16d57cde82bc76b234a\",\n                            \"lessThan\": \"6a19b18d458881bf3269a357cc6dc6db5eef4369\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7bdbf7446305cb65c510c16d57cde82bc76b234a\",\n                            \"lessThan\": \"5bbbce02e500d47d8e259a45be5a7be9741d0533\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/x86/net/bpf_jit_comp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.109\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/638bc3aada8ecdece184d5c15b100d489c9cccd7","https://git.kernel.org/stable/c/6886642414f59f928728802dc2c972a9859e6310","https://git.kernel.org/stable/c/6a19b18d458881bf3269a357cc6dc6db5eef4369","https://git.kernel.org/stable/c/5bbbce02e500d47d8e259a45be5a7be9741d0533"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89581","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89581","identifiers":["CVE-2026-89581"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T05:02:23.3236319+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T05:02:23.3236319+00:00","lastSuccessAt":"2026-11-09T05:02:23.479545+00:00","error":null,"lastVerifiedAt":"2026-11-09T05:02:23.4795489+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-61bf15172f364246efc204ad9b25e3f89710939e13c23b3efb3d009b5fdad808","complete":true,"records":421290,"lastAttemptAt":"2026-11-09T05:02:14.5383867+00:00","lastSuccessAt":"2026-11-09T05:02:14.5253969+00:00","error":null,"lastVerifiedAt":"2026-11-09T05:02:14.5383867+00:00","snapshotPublishedAt":"2026-11-09T04:29:38+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-4f2cebce00d8473081b28b769c5ae383","complete":false,"records":13654,"lastAttemptAt":"2026-11-09T05:14:17.7698071+00:00","lastSuccessAt":"2026-11-09T05:14:17.765+00:00","error":"8 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T05:14:17.765+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13657,"expectedIdentifiers":13706,"failedIdentifiers":8},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T05:02:23.3236319+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T05:02:23.3236319+00:00","lastSuccessAt":"2026-11-09T05:02:23.4802497+00:00","error":null,"lastVerifiedAt":"2026-11-09T05:02:23.4802499+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-5a44a451442747cb81d83104fe1e7771","complete":true,"records":13666,"lastAttemptAt":"2026-11-09T05:02:23.9456768+00:00","lastSuccessAt":"2026-11-09T02:08:52.274+00:00","error":null,"lastVerifiedAt":"2026-11-09T02:08:52.274+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T05:02:15.1760519+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T05:02:15.1760519+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T05:02:14.6871775+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T05:02:14.6871775+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f6d341f4320a5a0c059c28102ee651c3dd06abc87b84d2bafa4e2a823ec07d35","complete":true,"records":3056,"lastAttemptAt":"2026-11-09T05:02:23.2913664+00:00","lastSuccessAt":"2026-11-09T05:02:23.1539412+00:00","error":null,"lastVerifiedAt":"2026-11-09T05:02:23.2913664+00:00","snapshotPublishedAt":"2026-11-09T04:47:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-6a1c845b1938b1aa788f0e95c9ac8a8d5a1f07caed5d155840b0616b548c1455","complete":true,"records":231296,"lastAttemptAt":"2026-11-09T05:02:15.0730779+00:00","lastSuccessAt":"2026-11-09T04:03:49.859595+00:00","error":null,"lastVerifiedAt":"2026-11-09T05:02:15.0730779+00:00","snapshotPublishedAt":"2026-11-09T03:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}