In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpu_nr is a 32 bit value and… (CVE-2026-93147)
A high-severity vulnerability in the Linux kernel's s390 BPF implementation has been resolved. The issue involves the use of the 'ly' instruction, which loads a 32-bit cpu_nr value into a 64-bit register without zeroing the upper bits, potentially causing incorrect behavior. The fix replaces 'ly' with 'llgf', which correctly zeroes the upper bits when loading cpu_nr into BPF_REG_0.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel s390 BPF subsystem arises because the 'ly' instruction loads a 32-bit cpu_nr value into a 64-bit register (BPF_REG_0) without zeroing the upper 32 bits. This can lead to unintended data in the upper bits of the register. The patch replaces the 'ly' instruction with 'llgf', which properly zeroes the upper bits when loading cpu_nr, thereby resolving the issue.
Potential Impact
If exploited, this vulnerability could lead to incorrect kernel behavior due to improper register values, potentially impacting confidentiality, integrity, and availability of the system as indicated by the CVSS vector. The CVSS score of 7.8 reflects high severity with local attack vector, low complexity, requiring low privileges and no user interaction.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel by replacing the 'ly' instruction with 'llgf' in the s390 BPF code. Users should apply the official Linux kernel updates that include this patch to remediate the issue. Patch status is not explicitly provided in the input; therefore, check the vendor advisory for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpu_nr is a 32 bit value and… (CVE-2026-93147)
Description
A high-severity vulnerability in the Linux kernel's s390 BPF implementation has been resolved. The issue involves the use of the 'ly' instruction, which loads a 32-bit cpu_nr value into a 64-bit register without zeroing the upper bits, potentially causing incorrect behavior. The fix replaces 'ly' with 'llgf', which correctly zeroes the upper bits when loading cpu_nr into BPF_REG_0.
CVSS v3.1
Score 7.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel s390 BPF subsystem arises because the 'ly' instruction loads a 32-bit cpu_nr value into a 64-bit register (BPF_REG_0) without zeroing the upper 32 bits. This can lead to unintended data in the upper bits of the register. The patch replaces the 'ly' instruction with 'llgf', which properly zeroes the upper bits when loading cpu_nr, thereby resolving the issue.
Potential Impact
If exploited, this vulnerability could lead to incorrect kernel behavior due to improper register values, potentially impacting confidentiality, integrity, and availability of the system as indicated by the CVSS vector. The CVSS score of 7.8 reflects high severity with local attack vector, low complexity, requiring low privileges and no user interaction.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel by replacing the 'ly' instruction with 'llgf' in the s390 BPF code. Users should apply the official Linux kernel updates that include this patch to remediate the issue. Patch status is not explicitly provided in the input; therefore, check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fgfc-g2f4-qw94
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-93147"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6aade51755bf5e2cf5edc022
Added to database: 09/19/2026, 01:27:51 UTC
Last enriched: 09/19/2026, 01:42:34 UTC
Last updated: 09/19/2026, 01:42:34 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.