CVE-2026-93043 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disallow interpreter fallback for gotox insn
The interpreter does not recognize the BPF_JMP|BPF_JA|BPF_X insn, which is used for insn_array map. Thereafter, it would hit the BUG_ON() in ___bpf_prog_run() at run time.
[ 2.563726] BPF interpreter: unknown opcode 0d (imm: 0x0)
[ 2.564557] ------------[ cut here ]------------
[ 2.565206] kernel BUG at kernel/bpf/core.c:2349!
[ 2.565882] Oops: invalid opcode: 0000 [#1] SMP PTI
Set jit_required as true when insn_array map is used in the prog in order to disallow interpreter fallback for gotox insn in core.c::__bpf_prog_select_runtime().
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel's Berkeley Packet Filter (BPF) subsystem provides a powerful mechanism for executing user-defined programs within the kernel space, primarily utilized for networking and tracing purposes. A critical vulnerability was identified regarding the handling of specific instruction types during program execution, specifically involving the BPF_JMP|BPF_JA|BPF_X opcode. This particular instruction is designed to facilitate indirect jumps based on register values, a feature essential for programs utilizing insn_array maps which allow dynamic control flow structures within eBPF bytecode. The core issue stems from the fact that the standard software interpreter does not recognize this specific opcode variant as valid executable code in its default path.
When an eBPF program containing such instructions is loaded and executed without proper configuration, the BPF runtime environment encounters an unrecognized operation code during execution. This leads to a failure state where the kernel triggers a BUG_ON assertion within the ___bpf_prog_run function located in kernel/bpf/core.c. The resulting behavior manifests as a kernel panic or bug check, effectively causing a denial of service for any system relying on this specific BPF program configuration. The error logs typically indicate an unknown opcode and an invalid operation code, signaling that the interpreter attempted to process data it was not designed to handle in its fallback mode.
The root cause lies in the logic within __bpf_prog_select_runtime(), which determines whether a BPF program should be executed via the JIT compiler or fall back to the software interpreter. Previously, when an insn_array map was utilized, the system did not strictly enforce Just-In-Time compilation requirements for all instruction types present in the program. Consequently, if the JIT path was bypassed or unavailable, the fallback interpreter would attempt to execute instructions it could not parse, leading directly to the crash condition described above. This represents a significant stability risk as it allows user-space applications to trigger kernel-level crashes through specifically crafted BPF programs that leverage dynamic array-based control flow.
To mitigate this vulnerability, the fix involves modifying the program selection logic in core.c::__bpf_prog_select_runtime() to explicitly set jit_required to true when an insn_array map is detected within the eBPF program. By enforcing JIT compilation for these specific cases, the system ensures that only properly compiled and recognized machine code is executed, thereby bypassing the flawed software interpreter path entirely. This change aligns with security best practices by preventing unhandled instruction execution in privileged kernel space. From a classification perspective, this issue relates to CWE-20 Improper Input Validation, as the runtime environment failed to validate that all instructions were supported by the selected execution engine before proceeding. Furthermore, it touches upon ATT&CK technique T1059 Command and Scripting Interpreter abuse, where an attacker might attempt to exploit interpreter flaws for code execution or system disruption. System administrators should ensure their kernels are updated with patches addressing this BPF runtime validation logic to maintain stability against malformed eBPF programs.