CVE-2026-92485

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) component. Incorrect handling of trampoline flags during the release of a BPF tracing link can lead to corruption of the trampoline. This corruption prevents the proper restoration of program instructions, which may result in a kernel warning and a denial of service (DoS) condition. A local attacker could potentially trigger this flaw.

BPF trampoline flags can be corrupted because the verifier overwrites the existing trampoline flags when attaching fexit programs to a tail_call_reachable target. This can remove BPF_TRAMP_F_CALL_ORIG from a shared trampoline and later make link release fail to restore the patched instruction state correctly, producing a kernel WARNING and potentially leaving the trampoline in an inconsistent state. For the CVSS the PR:L is used for the paranoid score because some deployments delegate BPF capabilities such as CAP_BPF, CAP_PERFMON, or service level BPF loading without full host administration. The issue is not network reachable and requires local ability to load suitable BPF tracing programs. Impact is at least local denial of service or BPF control flow integrity degradation. In the worst still defensible interpretation it may have limited confidentiality or integrity impact because executable trampoline state is corrupted and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.