VulnerabilityPublished 26 Oct 2026

CVE-2026-99092: Linux kernel · riscv: patch: fix handling of bpf-jit execmem addresses

Source GCVE Database

Authoritative record:CVE-2026-99092· Medium

Not known to be exploited · fixed in f71d6ea3843c8038c431c2699482f246aea37ca0 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 16:31 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Patch: Available – fixed in f71d6ea3843c8038c431c2699482f246aea37ca0, a510e1ae8c9030750c2edf7b0bc9b186cd8c7a06, 562a35b9e0b3d9483d9472995219cadb3592db3d +1

Exploitation evidence

Disclosed: evidence found.
CVE published 26 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-m43v-97rg-mvc9

What to do

Upgrade Linux kernel to f71d6ea3843c8038c431c2699482f246aea37ca0, a510e1ae8c9030750c2edf7b0bc9b186cd8c7a06, 562a35b9e0b3d9483d9472995219cadb3592db3d or 9e8fc7972b398e9dc2415ece283d8f64edac3858.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 2c9e5d4a008293407836d29d35dfd4353615bd2f, < f71d6ea3843c8038c431c2699482f246aea37ca0	Fixed in f71d6ea3843c8038c431c2699482f246aea37ca0
LinuxLinux	Affected ≥ 2c9e5d4a008293407836d29d35dfd4353615bd2f, < a510e1ae8c9030750c2edf7b0bc9b186cd8c7a06	Fixed in a510e1ae8c9030750c2edf7b0bc9b186cd8c7a06
LinuxLinux	Affected ≥ 2c9e5d4a008293407836d29d35dfd4353615bd2f, < 562a35b9e0b3d9483d9472995219cadb3592db3d	Fixed in 562a35b9e0b3d9483d9472995219cadb3592db3d
LinuxLinux	Affected ≥ 2c9e5d4a008293407836d29d35dfd4353615bd2f, < 9e8fc7972b398e9dc2415ece283d8f64edac3858	Fixed in 9e8fc7972b398e9dc2415ece283d8f64edac3858
LinuxLinux	Affected =6.10	Fixed in–

AI-suggested

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel patch that corrects the handling of BPF JIT execmem addresses on RISC-V architectures. Until patched, systems with affected configurations may experience BPF JIT compilation failures, but no direct security exploit is known. No additional mitigation actions are specified beyond applying the official fix.

Description

A vulnerability in the Linux kernel's RISC-V architecture handling of BPF JIT execmem addresses was fixed. The issue involved incorrect assumptions about memory writability in the vmalloc area when CONFIG_STRICT_MODULE_RWX is disabled, causing BPF JIT compilation to fail due to page faults. This bug affects configurations where BPF text is read-only regardless of strict module RWX settings and can prevent BPF programs from being JIT-compiled. The fix aligns with similar corrections made on arm64 and involves proper handling of executable memory mappings in patch_map(). The vulnerability does not affect !CONFIG_MMU builds.

Impact

The vulnerability causes BPF programs on RISC-V Linux kernels to fail JIT compilation under certain configurations, specifically when CONFIG_STRICT_MODULE_RWX is disabled but BPF text is read-only. This results in BPF programs running without JIT optimizations, potentially degrading performance. There is no indication of security bypass or code execution impact. The bug triggers kernel warnings and errors during JIT compilation but does not cause crashes or memory corruption. The issue affects kernel configurations with CONFIG_EXECMEM selected and CONFIG_STRICT_MODULE_RWX disabled.

References

Community reviews

Loading reviews…