CVE-2026-92518riscv, bpf: Fix kernel stack corruption in tailcall with CFI
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix kernel stack corruption in tailcall with CFI When CONFIG_CFI_CLANG is enabled, prog->bpf_func already skips the kcfi instruction during setup. Including it again in the tailcall jump offset causes it to jump over an extra 4 bytes, skipping the stack pointer adjustment, which will result in kernel stack corruption.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 30a59cc79754fd9ff3f41b7ee2eb21da85988548 before 34b1bb33a025787e05f966e74de18cd36276f801; from 30a59cc79754fd9ff3f41b7ee2eb21da85988548 before a6e11a81da3420fd37f1518d4f238c4d5784086e; from 30a59cc79754fd9ff3f41b7ee2eb21da85988548 before 52fb1756ea1d2759dfef2d86245be00b05dac3a2; fe5b68fdcec0f3d97a32f4c4acfef59cf90718f7; from 6.11.6 before 6.12 | CNA record |
References
- https://git.kernel.org/stable/c/34b1bb33a025787e05f966e74de18cd36276f801
- https://git.kernel.org/stable/c/a6e11a81da3420fd37f1518d4f238c4d5784086e
- https://git.kernel.org/stable/c/52fb1756ea1d2759dfef2d86245be00b05dac3a2
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.