CVE-2026-89905 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: BPF: Move arena register slot below TCC context
Currently, the stack layout places the optional arena register slot above the tail call counter context. When arena_vm_start is dynamically enabled, it shifts the relative offset of the tcc_ptr slot within the stack frame, causing hardcoded tracking macros to mismatch and leading to memory misalignment or corruption potentially.
To fix this, move the arena register save and restore sequences below the tail call counter context slots in both build_prologue() and the epilogue.
Update __build_epilogue() to insert a proper offset decrement to safely skip the unneeded tcc_ptr reading block while accurately aligning with the relocated arena slot at the very bottom.
With this patch, the tcc_ptr slot is always positioned at a fixed distance directly underneath the base callee-saved registers that is independent of whether the arena features are on.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel for LoongArch architecture contains a critical stack layout vulnerability within its Berkeley Packet Filter (BPF) implementation, specifically concerning the interaction between dynamic arena register allocation and tail call counter context management. This issue arises from an incorrect ordering of data structures on the function stack frame during BPF program execution. The core technical flaw lies in the placement of the optional arena register slot relative to the tail call counter context. In the original design, the arena register slot was positioned above the tail call counter slots within the stack layout. This static arrangement fails to account for dynamic runtime conditions where the arena feature is enabled via the arena_vm_start flag. When this feature is active, the memory management logic shifts the relative offset of the tcc_ptr slot within the stack frame because it must accommodate the additional register state required by the arena mechanism.
This misalignment creates a severe integrity risk as the hardcoded tracking macros used to manage these stack slots rely on fixed or predictable offsets that no longer match the actual runtime layout. Consequently, when the kernel attempts to save and restore registers or access tail call counter data, it reads from or writes to incorrect memory addresses. This discrepancy leads directly to memory misalignment issues and potential heap corruption within the BPF execution environment. Such corruption can destabilize the kernel's virtual machine state, potentially leading to crashes, undefined behavior, or exploitation vectors where an attacker might leverage the corrupted stack frame to execute arbitrary code or escalate privileges by manipulating control flow data stored in these misaligned regions.
The resolution involves a structural reorganization of the BPF prologue and epilogue generation logic for LoongArch. The fix moves the arena register save and restore sequences below the tail call counter context slots, ensuring that the stack layout remains consistent regardless of whether dynamic arena features are enabled. Specifically, the __build_epilogue function was updated to insert a proper offset decrement mechanism. This adjustment allows the code to safely skip unneeded tcc_ptr reading blocks while accurately aligning with the relocated arena slot at the bottom of the frame. By enforcing this new order, the tcc_ptr slot is guaranteed to remain at a fixed distance directly underneath the base callee-saved registers. This independence from dynamic feature flags ensures that all stack access operations use correct offsets, thereby eliminating the risk of memory corruption associated with offset mismatches.
From a security classification perspective, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write, as the primary failure mode involves writing to or reading from incorrect stack locations due to flawed address calculation logic. In terms of attack vectors, it relates to ATT&CK technique T1059 Command and Scripting Interpreter through BPF programs, where malicious eBPF code could potentially exploit this memory corruption to bypass sandbox restrictions or compromise host integrity. Mitigation requires applying the kernel patch that reorders these stack frame components immediately upon availability for affected LoongArch systems. Administrators should ensure their kernels are updated to versions containing this fix and monitor system logs for any signs of BPF-related crashes or anomalies indicative of stack corruption attempts.