{"id":"CVE-2026-93270","revision":"ec17ccc2125241fd9d41c843dac63da3","records":[{"revision":"ec17ccc2125241fd9d41c843dac63da3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-93270","aliases":[],"title":"bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn\n\nThe BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for\n'dst_reg = src_reg + <percpu_base_off>'.\n\nHowever, the interpreter ignores the 'off' at its ALU64_MOV_X label.\nThe 'off' indicates the insn is BPF_MOV64_PERCPU_REG insn. Then, when\nthe interpreter loads memory from the register, it will hit a page\nfault.\n\n[    2.545572] BUG: unable to handle page fault for address: ffffffffacaaf034\n[    2.546485] #PF: supervisor read access in kernel mode\n[    2.547167] #PF: error_code(0x0000) - not-present page\n[    2.547850] PGD 134e63067 P4D 134e63067 PUD 134e64063 PMD 10021c063 PTE 800ffffeca550062\n[    2.548912] Oops: Oops: 0000 [#1] SMP PTI\n\nSet jit_required as true in order to disallow interpreter fallback in\ncore.c::__bpf_prog_select_runtime(), if any BPF_ADDR_PERCPU insn is\npatched to the prog.\n\nBTW, rename the helper bpf_map_supports_cpu_flags() to\nbpf_map_is_percpu_map().","state":0,"publishedAt":"2026-09-24T15:52:09.868+00:00","modifiedAt":"2026-10-19T09:08:24.811+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/bpf.h\",\n                        \"kernel/bpf/fixups.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7bdbf7446305cb65c510c16d57cde82bc76b234a\",\n                            \"lessThan\": \"57cf929a33cb76be3f24886073ae820b4c496914\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7bdbf7446305cb65c510c16d57cde82bc76b234a\",\n                            \"lessThan\": \"7a0855e73757ee9cf25ba635a1c735018ecba742\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/bpf.h\",\n                        \"kernel/bpf/fixups.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/57cf929a33cb76be3f24886073ae820b4c496914","https://git.kernel.org/stable/c/7a0855e73757ee9cf25ba635a1c735018ecba742"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-93270","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-93270","identifiers":["CVE-2026-93270"]},"retained":false,"historicalAffected":[]}],"coverage":[]}