bpf: Reject programs with inlined helpers if JIT is not available

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject programs with inlined helpers if JIT is not available When an architecture (such as LoongArch, ARM64, and RISC-V) implements bpf_jit_inlines_helper_call(), the verifier skips rewriting the helper call offset (insn->imm) in bpf_do_misc_fixups(). This is because the helper is expected to be inlined by the JIT compiler later. Therefore, insn->imm remains as the raw helper enum ID. However, if JIT is disabled at runtime (net.core.bpf_jit_enable=0) or if JIT compilation fails dynamically (e.g., due to OOM), the program falls back to the BPF interpreter. When the interpreter executes (__bpf_call_base + insn->imm) with the unpatched raw ID, it jumps into an invalid address space, triggering an instruction alignment fault or a kernel panic. Although these helpers have valid C implementations in the kernel, the omission of offset rewriting makes runtime interpreter fallback fatal. Fix this by setting 'prog->jit_required = 1' when helper call rewriting is skipped for JIT inlining. This ensures that such programs are safely rejected if JIT is not available, preventing the runtime kernel panic.

Timeline

1. Sep 17, 2026, 4:11 PM UTCCVE published
2. Oct 19, 2026, 9:06 AM UTCRecord last updated

Affected versions

• Linux Linux

  From 2ddec2c80b4402c293c7e6e0881cecaaf77e8cec · fixed in 21c6445366795fa3a89954e1d318e7c8afdef843; From 2ddec2c80b4402c293c7e6e0881cecaaf77e8cec · fixed in f1c27922576edccb99d0257827d09bd05c0304a6

• Linux Linux

  6.10

• KernelLinux

  From 6.10.0 · fixed in 7.2.6

References 2