CVE-2026-93044 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disallow interpreter fallback for arena-related insns
Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::__bpf_prog_select_runtime().
Currently, when the interpreter executes the arena ST/LDX/STX insns, it would hit the BUG_ON() in ___bpf_prog_run() at run time.
[ 2.579196] BPF interpreter: unknown opcode a2 (imm: 0x0)
[ 2.579998] ------------[ cut here ]------------
[ 2.580652] kernel BUG at kernel/bpf/core.c:2349!
[ 2.581314] Oops: invalid opcode: 0000 [#1] SMP PTI
Set jit_required as true when arena map is used in the prog to disallow interpreter fallback for arena-related insns.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's Berkeley Packet Filter (BPF) subsystem provides a powerful mechanism for running sandboxed programs within the kernel, primarily utilized for networking and tracing purposes. A critical vulnerability was identified regarding the selection of the BPF program execution runtime when specific instruction types are involved. Specifically, the issue arises with arena-related instructions, which are used to manage memory arenas that allow BPF programs to allocate dynamic memory. The core problem lies in the logic within the __bpf_prog_select_runtime function, where the kernel decides whether to use a Just-In-Time (JIT) compiler or fall back to an interpreted execution mode for the loaded BPF program.
Historically, if JIT compilation was not available or disabled for certain architectures or configurations, the system would attempt to execute the BPF bytecode using the built-in interpreter. However, this fallback mechanism did not account for the fact that the standard BPF interpreter does not support arena-related instructions such as store and load operations associated with memory arenas. Consequently, when a program utilizing these specific insns was executed via the interpreter path, it would encounter an undefined or unsupported opcode during runtime execution. This mismatch triggers a kernel BUG_ON condition in the ___bpf_prog_run function, leading to a fatal error that crashes the system.
The operational impact of this vulnerability is severe, manifesting as a local denial-of-service attack vector. An attacker with sufficient privileges to load and execute BPF programs can deliberately craft a program containing arena-related instructions. By forcing the kernel into an interpreter fallback scenario for such a program, they can trigger the invalid opcode exception described in the crash logs. This results in an immediate kernel panic or oops, causing system instability and requiring a reboot. The vulnerability effectively allows any user capable of loading BPF programs to disrupt service availability on the host machine without needing further exploitation steps beyond triggering the specific instruction set.
To resolve this issue, developers modified the __bpf_prog_select_runtime function in core.c to explicitly disallow interpreter fallback when arena-related instructions are detected within a program. The fix involves setting the jit_required flag to true whenever an arena map is used by the BPF program. This ensures that if JIT compilation is not available for the current architecture or configuration, the kernel will reject loading the program entirely rather than attempting to execute it with an incompatible interpreter. This preventive measure eliminates the runtime crash scenario by ensuring compatibility between the execution engine and the instruction set being utilized.
From a classification perspective, this vulnerability aligns with CWE-94, which covers Improper Control of Generation of Code or Commands, specifically in contexts where code generation fails to validate input constraints before execution. It also relates to CWE-253, as it involves an incorrect check for the availability of required features (JIT support) prior to allowing a fallback mechanism that lacks necessary capabilities. In terms of MITRE ATT&CK mapping, this flaw facilitates Local Privilege Escalation or Denial of Service through improper handling of system resources and execution contexts, particularly within the Linux kernel's security boundaries where BPF programs operate with elevated privileges but are supposed to be sandboxed.
Mitigation strategies for administrators involve ensuring that systems are updated with the latest kernel patches that include this fix. For environments where immediate patching is not possible, restricting the ability of unprivileged users or containers to load arbitrary BPF programs can reduce exposure. Additionally, monitoring system logs for patterns indicative of BPF interpreter errors and invalid opcode exceptions can help in early detection of attempted exploitation attempts. Maintaining strict controls over which capabilities are granted to processes capable of invoking bpf syscall operations is essential to preventing the loading of malicious or malformed bytecode that could trigger such kernel-level failures.