CVE-2026-92518
kernel: riscv, bpf: Fix kernel stack corruption in tailcall with CFI
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 17, 2026
Updated · October 20, 2026
Description
A flaw was found in the Linux kernel's RISC-V BPF JIT compiler. When Control-Flow Integrity (CFI) with Clang is enabled, an error in calculating the tail call jump offset can lead to kernel stack corruption. This issue causes the system to improperly adjust the stack pointer, which can result in system instability, crashes, or potentially allow an attacker to execute arbitrary code.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-823 · Use of Out-of-range Pointer Offset