CVE-2026-89581

A flaw was found in the Linux kernel's handling of Berkeley Packet Filter (BPF) programs on x86 architecture. An issue with how per-CPU addresses are resolved into extended registers can lead to incorrect memory access. A local attacker could exploit this by running a specially crafted BPF program. This could cause a kernel panic, resulting in a denial of service (DoS) to the system.

An x86 BPF JIT code generation bug resolves per CPU addresses into the wrong register when the destination is an extended register. The REX prefix uses REX.B instead of REX.R, so destinations such as R5, R7, R8, and R9 alias lower registers and the intended BPF register can keep an unadjusted per CPU pointer. A local actor who can load and run affected BPF programs can trigger a kernel crash when the JITed program dereferences the wrong pointer. For the CVSS the PR:L value is used because reliable triggering requires local BPF program execution or delegated BPF capability rather than full root in many practical environments. The issue is not network reachable. Impact is at least denial of service via kernel panic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.