CVE-2026-92485

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix WARNING in bpf_tracing_link_release

The trampoline could be corrupted by the blindly

'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier.

1. A fexit attached to a tail_call_reachable prog. 'tr->flags' became

'BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX'. And, the

trampoline would poke the target prog's nop insn using jmp insn instead

of call insn.

2. Another fexit loaded with the same tail_call_reachable prog target.

'tr->flags' became 'BPF_TRAMP_F_TAIL_CALL_CTX'.

3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in

'tr->flags', the trampoline will fail to restore the prog's nop insn

using call insn.

[ 3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98

...

[ 3.428793] bpf_link_free+0x58/0x130

[ 3.429293] bpf_link_release+0x23/0x30

Fix the warning by updating 'tr->flags' with '|=' and lock.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References