CVE-2026-93135

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject programs with inlined helpers if JIT is not available

When an architecture (such as LoongArch, ARM64, and RISC-V) implements

bpf_jit_inlines_helper_call(), the verifier skips rewriting the helper

call offset (insn->imm) in bpf_do_misc_fixups(). This is because the

helper is expected to be inlined by the JIT compiler later. Therefore,

insn->imm remains as the raw helper enum ID.

However, if JIT is disabled at runtime (net.core.bpf_jit_enable=0) or

if JIT compilation fails dynamically (e.g., due to OOM), the program

falls back to the BPF interpreter.

When the interpreter executes (__bpf_call_base + insn->imm) with the

unpatched raw ID, it jumps into an invalid address space, triggering

an instruction alignment fault or a kernel panic.

Although these helpers have valid C implementations in the kernel, the

omission of offset rewriting makes runtime interpreter fallback fatal.

Fix this by setting 'prog->ji

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References