CVE-2026-68285 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: BPF: Fix memory leak in bpf_jit_free()
When bpf_int_jit_compile() is called for subprograms, it returns early during the first pass (!prog->is_func || extra_pass is false), keeping ctx->offset alive for the subsequent extra pass.
If JIT compilation fails for a later subprogram, the BPF core aborts and calls bpf_jit_free() to clean up the first subprogram. However, bpf_jit_free() fails to free jit_data->ctx.offset, which causes a memory leak of the JIT context offsets array.
So fix this by adding the missing kvfree(jit_data->ctx.offset) in bpf_jit_free().
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability described affects the Linux kernel's LoongArch architecture implementation of Berkeley Packet Filter (BPF) just-in-time compilation functionality. This issue stems from improper memory management during the BPF JIT compilation process, specifically when handling subprograms within the BPF program execution context. The flaw manifests in the bpf_jit_free() function which fails to properly release all allocated memory resources during cleanup operations.
The technical root cause involves the bpf_jit_compile() function's behavior when processing subprograms. During the initial compilation pass, when certain conditions are met such as prog->is_func being true or extra_pass being false, the function returns early while leaving ctx->offset in an active state for subsequent processing phases. This design decision creates a scenario where memory allocated for JIT context offsets remains accessible but is not properly tracked for cleanup operations.
When later compilation attempts fail for subsequent subprograms, the BPF core system initiates an abort sequence that calls bpf_jit_free() to perform memory cleanup. However, this cleanup function contains a critical omission in its implementation - it fails to invoke kvfree() on jit_data->ctx.offset, leaving the JIT context offsets array allocated in memory without proper deallocation. This oversight results in a persistent memory leak that accumulates across multiple BPF program processing cycles.
The operational impact of this vulnerability extends beyond simple memory consumption issues, as it represents a classic resource management flaw that can lead to progressive system degradation over time. The memory leak affects the kernel's memory allocator and can potentially contribute to system instability, particularly in environments with high BPF program compilation activity or continuous network monitoring operations. This vulnerability directly violates the principle of proper resource cleanup and can be classified under CWE-404, which addresses improper resource management leading to memory leaks.
The fix implemented addresses this issue by explicitly adding the missing kvfree(jit_data->ctx.offset) call within the bpf_jit_free() function. This remediation ensures that all memory allocated for JIT context offsets is properly released during cleanup operations, thereby preventing the accumulation of leaked memory resources. The solution aligns with best practices for kernel memory management and follows the established patterns used elsewhere in the BPF subsystem for similar resource cleanup scenarios.
From an attack perspective, while this vulnerability primarily represents a denial-of-service vector through memory exhaustion rather than direct execution exploitation, it could potentially be leveraged to degrade system performance or availability. The vulnerability does not directly provide privilege escalation capabilities but can contribute to overall system instability. This type of memory leak falls under ATT&CK technique T1490, which addresses resource exhaustion and denial-of-service conditions through improper resource management in kernel components.