Linux kernel BPF x86 JIT: per-CPU address lands in the wrong register, clobbering RAX or the frame pointer

Impact

The JIT built the REX prefix for the per-CPU address MOV with add_1mod(), which sets REX.B - the bit that extends ModRM.rm and SIB.base. The instruction addresses memory as disp32 with no base, so the bit does nothing and the high destination-register bit is silently lost. Every extended-register destination resolves to whichever register shares its low three bits: R5 to RAX, R7 to RBP, R8 to RSI, R9 to RDI. The destination keeps an unadjusted address that the program then dereferences, and the aliased register is clobbered; the report includes a page fault and kernel panic in interrupt context. R7 aliasing RBP corrupts the frame pointer and R8/R9 alias argument registers, so the failure mode is not limited to a clean crash. Clang reloads the address before each per-CPU access and so never hits it, which is why this went unnoticed; GCC-built BPF keeps several per-CPU addresses live and panics the kernel.

Who can reach it

Local, requiring the ability to load a BPF program that the JIT compiles with an extended-register per-CPU address - in practice CAP_BPF or root, and today mostly programs built with GCC rather than Clang. The damage is done by the miscompiled program on the host, so a node running GCC-built BPF tooling is exposed without any attacker at all.

What to do

Take the stable kernel update that uses add_2mod() so the register goes through REX.R; encodings for non-extended registers are unchanged. Rollout is a kernel upgrade and a node reboot. Until then, avoid deploying GCC-compiled BPF programs on affected kernels - Clang-built programs do not produce the faulty encoding. The record gives four stable commits and no fixed version.

References

Related entries

• Linux kernel GHES: CXL CPER work locks taken without IRQ protection can deadlock a CPUCVE-2026-89589 · Linux kernel ACPI APEI GHES (CXL CPER work locks)Unscored
• Linux kernel hugetlb: reservation counter underflow when a parent unmaps a shared huge page firstCVE-2026-89593 · Linux kernel hugetlb (__unmap_hugepage_range reservation accounting)Unscored
• Linux kernel efivarfs: unprivileged statfs() floods the UEFI QueryVariableInfo runtime serviceCVE-2026-89604 · Linux kernel efivarfs (statfs handler, QueryVariableInfo rate limit)Unscored
• Linux CephFS client: unchecked dentry name length overflows a NAME_MAX buffer in the NFS re-export pathCVE-2026-89652 · Linux kernel CephFS client (ceph_get_name / __get_snap_name, NFS-export path)Unscored
• Linux CephFS client: out-of-range MDS rank in mdsmap export_targets writes past a stack bitmapCVE-2026-89653 · Linux kernel CephFS client (mdsmap decode, export_targets rank validation)Unscored
• Linux CephFS client: use-after-free on an MDS session freed while check_new_map drops mdsc->mutexCVE-2026-89654 · Linux kernel CephFS client (check_new_map, MDS session refcounting)Unscored